Bug 804964 - Spacewalk is using wrong db users in addition to defined user
Summary: Spacewalk is using wrong db users in addition to defined user
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Spacewalk
Classification: Community
Component: Server
Version: 1.7
Hardware: i686
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Jan Pazdziora (Red Hat)
QA Contact: Red Hat Satellite QA List
URL:
Whiteboard:
Depends On:
Blocks: space18
TreeView+ depends on / blocked
 
Reported: 2012-03-20 10:22 UTC by Alexander Davidsen
Modified: 2012-11-01 16:23 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-04-10 15:14:56 UTC
Embargoed:


Attachments (Terms of Use)

Description Alexander Davidsen 2012-03-20 10:22:06 UTC
Description of problem:
When monitoring our spacewalk oracle database we can see that the spacewalk application is connecting with the sys-user in addition to the original defined spacewalk-user. 

We see that the application is doing a number of queries using the sys-user, when it should be using the spacewalk-user. 

Our configuration only mentions the spacewalk-user, not the sys-user.

Version-Release number of selected component (if applicable):
1.7
Cent OS 5
External Oracle 11g Database. 
How reproducible:


Steps to Reproduce:
1. Use the http-interface, api or sync packages
2. Look at the sessions being initiated in oracle. Some of these will be executed as the sys-user. 
3.
  
Actual results:
Sys user are being used.

Expected results:
sys user should not be used. 

Additional info:

Comment 1 Michael Mráka 2012-03-20 10:56:05 UTC
Could you attach some of the queries which are run under sys user?

Comment 2 Alexander Davidsen 2012-03-20 16:55:26 UTC
I got this from my DBA:  

select host,userid,password,flag,authusr,authpwd, passwordx, authpwdx
from link$;

Comment 3 Jan Pazdziora (Red Hat) 2012-03-21 07:26:23 UTC
How could the Spacewalk machine possibly connect to your database as user sys when it has no way of knowing its password? When you change the password of your sys user, do the selects stop?

Comment 4 Alexander Davidsen 2012-03-21 07:50:40 UTC
I'll check further and get back to you.

Comment 5 Jan Pazdziora (Red Hat) 2012-03-26 08:33:49 UTC
Marking as waiting for the info.

Comment 6 Jan Pazdziora (Red Hat) 2012-04-10 15:14:56 UTC
Communication lost here.

I assume this is NOTABUG and the queries against link$ were not initiated by Spacewalk, let alone initiated by Spacewalk as sys user.


Note You need to log in before you can comment on or make changes to this bug.