Change passwords of many schemas under different databases without DBA privileges? - oracle

Question

We have many schemas under different databases. I do not have DBA privileges. I do have privileges to log-on to schemas and to change password. We do this password change ones in six months. Currently it's a manual and time consuming process. i.e. log-on to every schema under database/s and change password using "password" command. When I do password changes I have two files - current password and new password.
I log-on to each schema#database and issue following command –
alter user schema_name identified by new_password replace old_password;
Remember I don’t have DBA privileges; I can only log-on to schemas using username and password.
I thought about creating shell script and using “expect” from shell script. Though first trying to find out whether there is any easier approach. I am wondering is there a simple way of doing this either from SQL*Plus or from PL/SQL?

Answer 1

It seems impossible to do it using PLSQL or SQL*Plus because using both of them, you can execute from a single schema only and since there is no DBA privilege, you cannot do it for all schemas, rather you will end up running script after logging into each schema.
You can write a shell script that reads the two files and for each line, it inserts following data into the third file,
sqlplus -s username_1/old_password_1#oracle_instance <<EOF
alter user username_1 identified by new_password1 replace old_password_1;
exit
EOF
sqlplus -s username_2/old_password_2#oracle_instance <<EOF
alter user username_2 identified by new_password_2 replace old_password_2;
exit
EOF
.
.
.
sqlplus -s username_n/old_password_n#oracle_instance <<EOF
alter user username_n identified by new_password_n replace old_password_n;
exit
EOF
and so on
Once the third file is created, execute it after setting its permission to _rwxrwxrwx

Answer 2

You need to script this.
Input: List of tnsalias, List of (schema_name, old password, new password).
Here is the script I use when I alter my account on multiple databases.
$ cat alterpassword.py
"""Update oracle database passwords for user by typing the old and new password once.
"""
import cx_Oracle
import getpass
username = 'bjarte'
connect_strings = ['DB1.SUPERSITE.COM',
'DB2.SUPERSITE.COM',
'DB3.SUPERSITE.COM',
'DB4.SUPERSITE.COM',
'DB5.SUPERSITE.COM',
'DB6.SUPERSITE.COM']
def alter_password(username, old_password, new_password, tnsalias):
connect_string = "%s/%s#%s" % (username, old_password, tnsalias)
try:
connection = cx_Oracle.connect(connect_string)
try:
cursor = connection.cursor()
statement = "alter user %s identified by %s" % (username, new_password)
cursor.execute(statement)
return True
except:
return False
else:
cursor.close()
except:
return False
else:
connection.close()
if __name__ == '__main__':
print "Type in old password"
old_password = getpass.getpass()
print "Type in new password"
new_password = getpass.getpass()
for tnsalias in connect_strings:
success = alter_password(username, old_password, new_password, tnsalias)
if success:
print "password altered for user %s in database %s" % (username, tnsalias)
else:
print "password alternation failed for user %s in database %s" % (username, tnsalias)
You can adjust this script to read input from file and rewrite it in your favorite scripting language - bash, php, Perl, python, ruby or Powershell.
Side note: Schema accounts are not application login-accounts
schema accounts should always be locked (no need for a password change).
When you request for ddl changes for a specific schema, the DBA can open up and give you a password. When done, lock the schema account again.
schema-accounts are special. They own objects and can do ddl like: "drop objecttype objectname". You most likely don't want your applications to have these powerful privileges.