Re: Restricting internal access to users.

On 11 Aug 2003 09:15:07 -0700, jiju <jmkuruvilla_at_yahoo.com> wrote:

> hello,
>
> How do I restrict internal account access to database users? I created
> a user called user1 and granted him connect and resource privileges.
> Now after I connect as user1, I tried 'connect internal' and I get
> connected to the database as 'SYS' which is dangerous. How can I
> restrict this such that when user1 tries to 'connect internal' it will
> prompt for the password. Please help.
>
> Thanks in advance.
>
> jiju

You've got good replies from others: you've inadvertently set up operating system authentication for privileged users, and that's how come your "ordinary" user is connecting internal. Remove the user from the relavant O/S group, and he won't be able to do that. If you want to abandon operating system authentication altogether, then you'll need to use the orapwd utility to create a new password file, and edit the init.ora so that REMOTE_LOGIN_PASSWORDFILE=EXCLUSIVE. But a couple of other points: you should never grant connect and resource to a user. Those are not "privileges", they are *roles*. And the key feature of a role is that it is a *collection* of privileges, and that means you've granted an awful lot more to that user than you might expect. For new users, just grant 'create session', and then specific privileges as required ('select any table', for example. Or specific objecty privileges such as 'select on emp').

Lastly, you don't mention an operating system or a version (two essential nuggets of information). But if this is any Oracle version higher than or equal to 8.0, then you shouldn't be connecting as internal anyway. Internal is dead as of 9i, and so you'd want to not get into bad habits. Connect "sys/something AS SYSDBA" is the new, approved way of doing the same thing, and it has a future.

~QM Received on Mon Aug 11 2003 - 17:02:56 CDT