Simple Security Questions
Palooka
SYSTEM
MGMT_VIEW
OUTLN
None of these ever log in, according to DBA_AUDIT_TRAIL. I have session
auditing on.
Also, should I create a new role, with various system privileges, to
replace the "burned in" DBA role, and grant that to myself rather than DBA?
For information, we are using the database, OEM and RMAN. No RAC, no
Oracle Applications, no ASM, no DataGuard.
Jobs are scheduled with the newer database scheduler, not DBMS_JOB. Is
it therefore OK to set JOB_QUEUE_PROCESSES to zero?
Thanks,
Palooka
sybrandb
One wonders why search engines and online documentation exists, if it
isn't used anyway.
--
Sybrand Bakker
Senior Oracle DBA
Mark D Powell
>
> - Show quoted text -
Palooka,
Yes you can lock the listed user accounts.
From the DBA Administration manual >>
The initialization parameter JOB_QUEUE_PROCESSES only applies to
DBMS_JOB. When DBMS_SCHEDULER is used, the coordinator will
automatically determine how many job slaves to start based on CPU load
and the number of outstanding jobs
<<
However, you should check the Reference manual entry for
job_queue_processes before you set it off to be sure you do not use
any of the other features it supports.
HTH -- Mark D Powell --
Steve Howard
> Can I safely lock the following accounts (10.2.0.4)?
>
> SYSTEM
> MGMT_VIEW
> OUTLN
>
> None of these ever log in, according to DBA_AUDIT_TRAIL. I have session
> auditing on.
>
This is an interesting question. Most shops advocate not using SYSTEM
on a regular basis, but I also have never heard a suggestion to lock
it, either. I would defer to being conservative and not locking it,
though. My guess is Oracle wouldn't even support it, but that is
exactly that...a guess.
OUTLN I think is already locked by default. For MGMT_VIEW I have no
clue. It doesn't look like it is locked by default, though. The
following may be of interest...
http://www.oracle.com/technology/products/oem/pdf/Security_Paper_OOW_06.pdf
> Also, should I create a new role, with various system privileges, to
> replace the "burned in" DBA role, and grant that to myself rather than DBA?
>
I think the new role is a good idea. We did this some time ago by
reverse engineering the existing DBA role and extracting from it what
we actually used.
> For information, we are using the database, OEM and RMAN. No RAC, no
> Oracle Applications, no ASM, no DataGuard.
>
> Jobs are scheduled with the newer database scheduler, not DBMS_JOB. Is
> it therefore OK to set JOB_QUEUE_PROCESSES to zero?
>
JOB_QUEUE_PROCESSES is still used for materialized views updates and I
think streams queues.
gazzag
> One wonders why search engines and online documentation exists, if it
> isn't used anyway.
>
> --
> Sybrand Bakker
>
To be fair to Palooka, Sybrand, he's not known around here for asking
simple RTM questions. And I think that with the range of experience
that regular posters to this group have, I think this could be an
interesting discussion piece.
Steve, thanks for the pointer to the EMGC white paper.
-g
Palooka
Thank you Steve and Mark, for your observations.
I have read much documentation, but the complete answers were not
entirely apparent, at any rate to me. I shall read with interest the
white paper which Steve mentions.
Steve's remark about Oracle possibly not supporting locking the SYSTEM
account is a little worrisome. Maybe I'll raise a SR - and report back.
Cheers,
Palooka
DA Morgan
> I would defer to being conservative and not locking it,
> though. My guess is Oracle wouldn't even support it, but that is
> exactly that...a guess.
Being conservative means locking everything you can. I am not
aware of any reason Oracle Support would care.
--
Daniel A. Morgan
Oracle Ace Director & Instructor
University of Washington
damo...@x.washington.edu (replace x with u to respond)
Puget Sound Oracle Users Group
www.psoug.org