Re: oinstall vs. dba UNIX Group

From: HansF <Fuzzy.Greybeard_at_gmail.com>
Date: Sun, 18 Feb 2007 14:37:38 GMT
Message-Id: <pan.2007.02.18.14.37.34.489463@gmail.com>

On Sun, 18 Feb 2007 05:59:23 -0800, hpuxrac wrote:

> On Feb 16, 10:10 pm, HansF <Fuzzy.Greybe..._at_gmail.com> wrote:

>> On Fri, 16 Feb 2007 13:12:17 -0800, Michael42 wrote:> separation of the jobs to install the software vs the daily operations.

>

>> > From your point of view, what are the pros and cons of using oinstall
>> > as the primary group rather than dba?
>>
>> I'm thinking that this is yet another SarbOx reaction - auditable

>
> Well it could only be a reaction if this was changed and then
> standardized/recommended by oracle "after" sox. But it's been around
> for a very long time.

The intention of my statement was to highlight the rationalle used by SarbOx (job separation, auditability) rather than blame SarbOx specifically.

Oracle has being promoting logical job separation for a loooooong time - Chapter 1 of the Administrator's Guide has made that clear, way back to Oracle 7.0 and possibly earlier.

Sorry for being unclear.

>

>>
>> In the installs I;ve done, I have not seen an impact either way on the
>> operation.
>>
>> That said, oinstall is a group that has write access to the inventory
>> whereas dba typically does not.
>>
>> Implication is simple - does your shop permit the general DBA to manage
>> patches?  If yes, then no impact ... if no, then keep 'em separate.

>
> Probably I should have been clearer in my original reply.
>
> Does my shop use the oinstall and dba groups? Yes we do.
>
> Do we really need to operate like that. Not really.
>
> If a shop has done the oracle installs and just used the dba group is
> that a problem? No.

In that we agree. You can take my response as further supporting yours.

---
Hans Forbrich   (mailto: Fuzzy.GreyBeard_at_gmail.com)   
*** Feel free to correct me when I'm wrong!
*** Top posting [replies] guarantees I won't respond.

Received on Sun Feb 18 2007 - 08:37:38 CST