EXPERT RESPONSE
To verify this, I performed the following:
SQL> connect peasland as sysdba
Enter password:
Connected.
The PEASLAND user has never been granted SYSDBA
privileges, so on the surface, this never should have
happened. But I launched SQL*Plus as a "privileged"
user in the first place. My database is running on a
Unix server. I signed on to the Unix server as a
member of the 'dba' group. If I was on a Windows
server, I would need to sign on as a member of the
'ora_dba' group. Anyone who is signed on to the
database server and is a member of this group can
connect to the database as SYSDBA using any userid.
This only becomes a security hole if you place users
who should not have this privilege in that specific
group. Only Database Administrator OS accounts should
be part of these groups. Regular users should not be
granted permissions for this group. If a regular user
attempts the same commands above, they would be given
an error message indicating that they do not have
sufficient permissions. Also note that this only
pertains to those accounts that log in directly to the
database server. If someone is connecting to the
database from a remote workstation, this operation
will not work.
For More Information
|
