When folks talk about UNIX security and the tools
available to prevent mishaps, it is important to remember just how
fragile the UNIX environment can be. The primary job of the UNIX
Oracle DBA is keeping the database running, so they are not usually
surprised to see how easy it is to clobber a server.
The script below cripples the UNIX server by an
implosion of incoming jobs. This is known as a Denial Of Service
(DOS) attack, and the Oracle DBA should be aware just how easy it is
for a hacker to make a mess in UNIX.
Interestingly, the use of a DOS attack is
not new and mainframe programmers have known how to clobber a
mainframe job intiator since the 1960’s.
The same kind of attack can be launched against
IBM mainframes by creating a recursive IEFBR14 job that directs its
SYSOUT to the mainframe internal reader.
The following is a section of JCL that
illustrates the recursive job submission technique.
//EXEC
IEFBR14
//DD SYSIN=IBM.MISC(CRASH),DISP-SHR
//DD
SYSOUT=(,,INTRDR)
WARNING: The following command will clobber
any UNIX server in a matter in just a few seconds. This script
is provided for illustration purposes only, and it should not ever
be run in a production environment:
nohup
/tmp/recursive.ksh > /dev/null 2>&1 &
The recursive.ksh file
submits two of the same tasks.
nohup /tmp/recursive.ksh >
/dev/null 2>&1 &
nohup /tmp/recursive.ksh > /dev/null 2>&1 &
Because the job submits itself, two jobs submit
4, four submit 16, and so on, until the entire server in unable to
accept any work.
Again this script is described as a warning to
any cocky Oracle DBA who assures management that their UNIX server
is impervious to DOS attacks.
|
|
 |
|
Guarantee your Success!
Oracle is the
world's most complex, robust and flexible database, considered
impossible to master without a mentor.
That's why all BC
Oracle trainers are working professionals, experts in Oracle who
share their tips and secrets. |
|
| |
|
Burleson is the American Team
Note:
This Oracle
documentation was created as a support and Oracle training reference for use by our
DBA performance tuning consulting professionals.
Feel free to ask questions on our
Oracle forum.
Verify
experience!
Anyone
considering using the services of an Oracle support expert should
independently investigate their credentials and experience, and not rely on
advertisements and self-proclaimed expertise. All legitimate Oracle experts
publish
their Oracle
qualifications.
Errata?
Oracle technology is changing and we
strive to update our BC Oracle support information. If you find an error
or have a suggestion for improving our content, we would appreciate your
feedback. Just
e-mail:
 and include the URL for the page.
Copyright ? 1996 - 2012
All rights reserved.
Oracle ?
is the registered trademark of Oracle Corporation.
|
|
