Finding and Changing Default Passwords

When you install Oracle Database, the default database user accounts, including administrative accounts, are created without default passwords. Except for the administrative accounts whose passwords you create during installation (such as user SYS), the default user accounts arrive locked with their passwords expired. If you have upgraded from a previous release of Oracle Database, you may have database accounts that still have default passwords. These are default accounts that are created when you create a database, such as the HR, OE, and SCOTT accounts.

Security is most easily compromised when a default database user account still has a default password after installation. This is particularly true for the user account SCOTT, which is a well known account that may be vulnerable to intruders. Find accounts that use default passwords and then change their passwords.

To find and change default passwords: 

1. Log into SQL*Plus with administrative privileges.

   sqlplus system
   Enter password: password
   

2. Select from the DBA_USERS_WITH_DEFPWD data dictionary view.

   SELECT * FROM DBA_USERS_WITH_DEFPWD;
   

   The DBA_USERS_WITH_DEFPWD lists the accounts that still have user default passwords. For example:

   USERNAME
   ------------
   SCOTT
   

3. Change the password for the accounts the DBA_USERS_WITH_DEFPWD data dictionary view lists.

   For example, to change the password for user SCOTT, enter the following:

   PASSWORD SCOTT
   Changing password for SCOTT
   New password: password
   Retype new password: password
   Password changed
   

   Replace password with a password that is secure, according to the guidelines listed in "Requirements for Creating Passwords". For greater security, do not reuse the same password that was used in previous releases of Oracle Database.

   Alternatively, you can use the ALTER USER SQL statement to change the password:

   ALTER USER SCOTT IDENTIFIED BY password;
   

You can use Database Control to change a user account passwords (not just the default user account passwords) if you have administrative privileges. Individual users can also use Database Control to change their own passwords.

To use Database Control to change the password of a database account:  

1. Start Database Control.

   See Accessing the Database Home Page for instructions about how to start Database Control.

2. Enter an administrator user name and password (for example, SYSTEM), and then click Login.

3. Click Server to display the Server subpage.

4. In the Security section, click Users.

   The Users page lists the user accounts created for the current database instance. The Account Status column indicates whether an account is expired, locked, or open.

5. In the Select column, select the account you want to change, and then click Edit.

   The Edit User page appears.

6. Enter a new password in the Enter Password and Confirm Password fields.

7. Click Apply.