> How do I force software owner oracle to login with username / password
> and not rely on OS authentication on Linux/UNIX?

Try adding
SQLNET.AUTHENTICATION_SERVICES = (NONE)
to sqlnet.ora to disable OS authentication. In fact, on UNIX, you can set it to 
anything other than ALL, such as NTS which is used on Windows, or 
anystringyouwant.

Documentation says the default for this setting is None. But that None really 
means there's no default, not the word 'NONE'.

The password file $ORACLE_HOME/dbs/orapw<SID> has no effect on whether oracle can
login with no password by sqlplus "/ as sysdba", if oracle owns the software
and runs the instance. But without the password file, v$pwfile_users has no entry,
not even SYS.

----------------------------------------------------------------------------------------------------

Test of mixed setting (e.g. SQLNET.AUTHENTICATION_SERVICES = (none, radius)):
(Warning: this is not recommended according to 
http://download.oracle.com/docs/cd/B19306_01/network.102/b14213/sqlnet.htm#sthref443 )

Test on Windows 10.1.0.3 unless otherwise indicated. OS user is in ORA_DBA 
group. No advanced security is configured.

SQLNET.AUTHENTICATION_SERVICES
Setting                        Result
------------------------------ ----------------------------------
Group 1:
nts                            connected

Group 2:
[not set]                      ORA-1031 (insufficient privileges)

Group 3:
auto                           ORA-1031; same below
none
dcegssapi
nosuchstring

Group 4:
all                            ORA-12641 (Authentication service failed to initialize); same below
kerberos5
radius


* Mixing Group 1 (i.e. 'nts') with any option in Group 3 or 'all' in Group 4 => 
  connected
* Mixing either Group 1 or 3 with Group 4 option => ORA-12641

Comments:

1. Options are case-insensitive.
2. In mixed setting, order of options and spaces after comma or lack of are 
   irrelevant.
3. Only two-option mixing is tested.
4. Setting of remote_login_password is irrelevant (can be either none or 
   exclusive or shared).
5. In 9i (tested in 9.2.0.1.0 on Windows), in cases I would get ORA-12641 in 
   10g, I get ORA-1031. Mixed setting result differs a little ('nts' can mix 
   with anything and get authenticated).