I have a AWS Oracle Database 12c Enterprise Edition Release DB,
I want to kill a session using the Master username.
set role dba;
alter user MY_MASTER_USER default role connect, dba;
But when I run alter system kill session '14,60599'; from MY_MASTER_USER user I got this error:
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to perform a database operation without
the necessary privileges.
*Action: Ask your database administrator or designated security
administrator to grant you the necessary privileges
A little googling gave me this:
http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.System.html#Appendix.Oracle.CommonDBATasks.KillingSession
begin
rdsadmin.rdsadmin_util.kill(
sid => sid,
serial => serial_number);
end;
/
Related
Getting ORA-00990: missing or invalid privilege while running the below query on Oracle 11g r2 :
grant inherit any privileges to dbuser1;
Any suggestions on this.
Suggestion is to upgrade to at least 12c to use it. It doesn't exist in 11g, as far as I can tell.
This privilege is first documented in Oracle 12.1
INHERIT PRIVILEGES and INHERIT ANY PRIVILEGES Privileges
Before Oracle Database 12c, an IR unit always ran with the privileges of its invoker. If its invoker had higher privileges than its owner, then the IR unit might perform operations unintended by, or forbidden to, its owner.
As of Oracle Database 12c, an IR unit can run with the privileges of its invoker only if its owner has either the INHERIT PRIVILEGES privilege on the invoker or the INHERIT ANY PRIVILEGES privilege.
These two privileges don't get granted to the DBA:
SYSDBA
SYSOPER
SQL and GUI attempts to grant these privileges return successful messages, but they remain revoked. While signed in as SYS:
Signing in as SYS
Bookshop_DBA privileges appear as such
Granting with GUI
Granting with SQL
Result for both
Messages are returned to say that granting is successful but no changes are made.
Please show us what you're actually doing.
If you're using the dialog as shown, and getting problems, you should be able to report an any ORA- errors.
For example:
And you don't have to guess what SQL Developer is actually doing - click on the SQL page of the edit user dialog.
Before going further, please consider:
you should in general NEVER login as SYSDBA - unless you need to actually shut down or alter a database. Don't use it as an all powerful PRIV to get around security/grant issues
you should know what you're doing before you grant it to someone, or even use it yourself. Read the docs, then read them again. Otherwise, this is how you do very, very bad things to your database.
Running this code from a non-privileged user:
-- SYSTEM PRIVILEGES
GRANT SYSDBA TO "user" ;
GRANT SYSOPER TO "user" ;
Error starting at line : 6 in command -
GRANT SYSDBA TO "user"
Error report -
ORA-01031: insufficient privileges
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to perform a database operation without
the necessary privileges.
*Action: Ask your database administrator or designated security
administrator to grant you the necessary privileges
Error starting at line : 7 in command -
GRANT SYSOPER TO "user"
Error report -
ORA-01031: insufficient privileges
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to perform a database operation without
the necessary privileges.
*Action: Ask your database administrator or designated security
administrator to grant you the necessary privileges
So, how do we get around this?
You need to do this for the user who is performing the grants - and you better REALLY trust this user, if you're going to let them do this SYSDBA...
GRANT SYSDBA TO "*user*" WITH ADMIN OPTION;
But, that's NOT ENOUGH.
Per the DOCS:
Because SYSDBA and SYSOPER are the most powerful database privileges,
the WITH ADMIN OPTION is not used in the GRANT statement. That is, the
grantee cannot in turn grant the SYSDBA or SYSOPER privilege to
another user. Only a user currently connected as SYSDBA can grant or
revoke another user's SYSDBA or SYSOPER system privileges. These
privileges cannot be granted to roles, because roles are available
only after database startup. Do not confuse the SYSDBA and SYSOPER
database privileges with operating system roles.
So, in SQL Developer, disconnect.
Change your connection properties:
Now that you're connected as SYSDBA, you can do...perilous things...like grant that to someone else.
PS - Don't ever GRANT SYS anything to a demo schema like HR. And don't have these demo schemas in production environments, they're only there as learning resources.
It may be due to the user you are connected with. SYSDBA and SYSOPER privs can only be granted by a SYSDBA user.
I have Oracle 11G SE1 on AWS RDS.
I'm trying to do :
CREATE RESTORE POINT RestorePointName GUARANTEE FLASHBACK DATABASE;
and I'm getting :
Error at Command Line:1 Column:1
Error report:
SQL Error: ORA-01031: insufficient privileges
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to change the current username or password
without the appropriate privilege. This error also occurs if
attempting to install a database without the necessary operating
system privileges.
When Trusted Oracle is configure in DBMS MAC, this error may occur
if the user was granted the necessary privilege at a higher label
than the current login.
*Action: Ask the database administrator to perform the operation or grant
the required privileges.
For Trusted Oracle users getting this error although granted the
the appropriate privilege at a higher label, ask the database
administrator to regrant the privilege at the appropriate label.
I'm logged in as the admin user.
I am getting the following error while connecting to db for checking db timings through QTP scripts:
"Cannot update system time with database time due to error: ERROR: [Oracle][ODBC][Ora]ORA-28000: the account is locked"
But the database SID and credentials given are correct and verified the same in some db client. I am not sure why its throwing error in QTP?
Can anyone please help me resolve the issue?
1) Login to your Oracle Database using admin privileges:
cmd> sqlplus / as sysdba
or
cmd> sqlplus system/{systemPassword}#{OracleSID}
2) Unlock your user's account using the following command:
sql> alter user {yourDbUser} account unlock;
3) Still in SQL*Plus command prompt, prevent account locks to not occur again:
sql> ALTER PROFILE "DEFAULT" LIMIT PASSWORD_LIFE_TIME UNLIMITED;
sql> ALTER PROFILE "DEFAULT" LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;
Edit due comment
The above instructions should solve your problem. I'm posting an additional command I've found related to this subject you can try (I'm not confident it is the solution though):
sql> grant connect, resource to {yourDbUser};
You can also check for the status of other locked users in your database. Maybe your tool is trying to connect with some other user that, besides the one you are using, still have this issue.
This solution is for Oracle 10g and error ORA-28000:the account is locked
Type in the SQL Command Line:
conn sys as sysdba
enter password
alter user system account unlock;
i was running an insert query on a synonym i got ORA-01031 in sql developer, we are accessing almost all tables through synonym only, but only this one in the schema gave ORA-0103 error. Please guide.
Error report: SQL Error: ORA-01031: insufficient privileges
01031. 00000 - "insufficient privileges"
*Cause: An attempt was made to change the current username or password
without the appropriate privilege. This error also occurs if
attempting to install a database without the necessary operating
system privileges.
When Trusted Oracle is configure in DBMS MAC, this error may occur
if the user was granted the necessary privilege at a higher label
than the current login.
*Action: Ask the database administrator to perform the operation or grant
the required privileges.
For Trusted Oracle users getting this error although granted the
the appropriate privilege at a higher label, ask the database
administrator to regrant the privilege at the appropriate label.
did you execute something like:
GRANT select, insert, update, delete on Table to your_synonym_user;
and this line should be executed by the Table owner or the user with that permission.
It looks very much like the permissions you have to either the underlying table, or the synonym are insufficient, or possibly that your password has expired?