For our application we're using outsorced Oracle administration. Now we'd like to prevent external oracle administrator from changing our data (DELETE, INSERT, UPDATE).
Is there any way how to do it?
Is there possible to REVOKE eg. UPDATE ANY TABLE to SYS account and is this sufficient?
I have read the Oracle Security Guide but haven't found anything. Only a statement: Do not use a DBA role which contains eg. the UPDATE ANY TABLE privilege.
I see I also should REVOKE GRANT ANY PRIVILEGE ...
Simply I'd need a complex guide how to do it and I'm not able to find any document about it.
Thanks
Related
Is there a way to grant privileges of select, insert, update and delete to a user so that if we add a new table later, the user still have these privileges on the new table ?
Thanks for help,
The quickest and dirtiest way to go about something like this is to create a trigger on all create table statements in the DB, and then granting privileges on tables fitting your pre-defined conditions.
However, I don't see why not to add a grant command to every create table command ran in the system.
Bear in mind that DDLs and grant commands are not something to be taken lightly. Designing your schema and its privileges should be done with careful thought, and automating is a recipe for problems further down the road.
Although not a recommended practice for security reasons on a development instance this is acceptable
grant select, insert, update, delete any table to your_user;
I stress again that this allows that user access to any table in any schema except SYS and is not a best practice.
I would like to know if there is a way to grant permissions to, for example, create table on a schema, from a different user.
I want to do this without granting DBA role, nor granting "ANY" permissions (grant create any table to XXXX).
I use this occasionally to satisfy devs who want a read-only account. This will create DDL that will give appropriate select or execute permissions. It would not be difficult to modify that to include update and delete.
I'm using Oracle's 10g version.
In the database, I would like to create a configuration table and fill it with data.
Then the other users can not change anything in it, and even better that it was not at all visible to other users. Is it possible to somehow hide the table?
Regards
Create a separate schema for that table. Create a package that provides an API to your configuration data (e.g. to get a value that is needed by another program).
Revoke CREATE SESSION privilege from that schema (i.e. just don't grant any privileges to the schema at all). Don't grant any privileges on the table. The only users who will be able to see the table are those with DBA privileges.
The only thing that database sessions will be able to do is execute the package, IF they have been granted EXECUTE privilege on it.
If you do not grant enough privileges to other users, they could not see your objects.
I have an oracle graphics application that works with a 10G database, however with a 11G DB it doesnt as it refuses to see some tables in the DB, i think it has to do with privelages and roles. Does anyone know how to grant roles in the graphics program. I was thinking that at in the OPEN TRIGGER i can grant the tables to public , eg: GRANT ALTER, DELETE, INDEX, INSERT, REFERENCES, SELECT, UPDATE ON GENDBA.SUPLOCATIONS TO PUBLIC; and in the close trigger i can revoke the grant therby retaining the security of the DB tables.
Can anyone out there help me?
thanks tbone. what we have done is gotten scripts to block access to the database from toad , sqtools etc and all similar programs so users wouldnt be able to access the database (only given them forms access) and removed the passwords from all the tables. well something like that and the graphics seem to work. Thanks guys
I have to install an application server that requires an user to write to the database, possibly create new schemes and such. However, I've always used the "work around" to assign the DBA Role to that user.
I have some questions, as I am not that deep into Oracle security.
Has the DBA role a level of privileges that can affect the whole Oracle installation?
Where can I find what privileges the DBA role exactly have?
How do I create an alternative role?
Thanks,
1) Yes, the dba role should have enough privileges to screw up a database beyond fixing.
2)
select *
from role_sys_privs
where grantee = 'DBA';
3) Unless you plan on having several user with similar privileges, I recommend creating a user and grant all needed privileges explicitly to this user instead of via a role.
You can read more about the topic in
Oracle Database Security Guide chapter 11, Administering User Privileges, Roles, and Profiles
First look into Ronnis' solution. If this is not sufficient create a package, owned by SYSTEM, and grant EXECUTE to the user or users that need it. Add procedures that perform the needed operations taking care to limit their power as much as possible.