Re: OK to revoke privileges from SYS or DBA?

From: DA Morgan <damorgan_at_x.washington.edu>
Date: Mon, 06 Dec 2004 19:07:11 -0800
Message-ID: <1102388728.155618@yasure>

hpuxrac wrote:

> DA Morgan wrote:
>
> snip
>
>

>>I'd drop the DBA role completely as that is what Oracle advises. It
>>exists, like CONNECT and RESOURCE solely for demonstration purposes
>>just as does SCOTT/TIGER.

>
>
> I disagree. Securing access to oracle provided roles is one thing,
> recommending dropping the roles is another thing altogether.
>
> I for one have never heard anyone from oracle advising the DBA role
> should be dropped.
>
> John

My information has been corrected and I agree with respect to the DBA role. I still think CONNECT and RESOURCE should be trashed. Whether that means dropping them or just clearing out the privs that are not appropriate is something each DBA should decide for him or her self. My preference is to drop them.

-- 
Daniel A. Morgan
University of Washington
damorgan_at_x.washington.edu
(replace 'x' with 'u' to respond)

Received on Mon Dec 06 2004 - 21:07:11 CST