Re: OK to revoke privileges from SYS or DBA?

I must admit, this is one REALLY good advice. (And this kind of advice is usually not free (if we are talking about some 3rd party commsec consultant):_))

I agree with DA Morgan, since I know some REAL cases of intrusion through well-known pre-existing RESOURCE and DBA roles. Besides of that, we are talking about PRODUCTION, so what relation those rdbms/admin
scripts have to "official production environment"? Even more, they MUST NOT BE there at all :-)

It is very similar like you still have gcc/make on production server ... $-)

On Mon, 06 Dec 2004 08:17:04 -0800, DA Morgan <damorgan_at_x.washington.edu> wrote:

> I agree. But I have read elsewhere specific advice to drop them as they
> are a security risk just by existing. Alternatively one can keep the
> roles but drop those privs from them that are inappropriate.
>
> I disagree that dropping CONNECT and RESOURCE will screw up any
> aspect of Oracle. But if you insist certainly one could edit those
> default roles to remove inappropriate privileges. What end-user,
> for example, needs the ability to create clusters and database links?
> And what DBA would want them to if they even knew what they were?
Received on Mon Dec 06 2004 - 20:38:40 CST