Tyring to get a better understanding of ORACLE admin accounts

oracleoracle-12c

In reviewing some configuration information for an ORACLE 12C server, I see that the only user assigned the DBA role appears to be SYS account. Also, the only user shown with SYSDBA and SYSOPER privileges appears to be SYS account. My understanding is that these are built in accounts that can perform all administrative functions. Absent other user accounts, it seems to indicate that the SYS account is used to perform day to days admin functions. Shouldn't there be a "named" user with appropriately assigned privileges,versus using the SYS account?

Best Answer

Yes, there should be. Even the documentation mentions that:

Administrative User Accounts

Create at least one additional administrative user and grant to that user an appropriate administrative role to use when performing daily administrative tasks. Do not use SYS and SYSTEM for these purposes.

But the database can not force you to do this. It is a discipline that some companies follow, while other companies ignore.

Related Solutions

Understanding oracle SCN

According to the Glossary from the Oracle Documentation

System Change Number. A database ordering primitive. The value of an SCN is the logical point in time at which changes are made to a database.

There is lots of info you can easily Google

Even the DBA StackExchange already has questions around the SCN

Oracle – How Does the SYS User Get SYSDBA Privilege?

From the 12c docs:

The SYS user is automatically granted the SYSDBA privilege upon installation. When you log in as user SYS, you must connect to the database as SYSDBA or SYSOPER. Connecting as a SYSDBA user invokes the SYSDBA privilege; connecting as SYSOPER invokes the SYSOPER privilege. Oracle Enterprise Manager Database Control does not permit you to log in as user SYS without connecting as SYSDBA or SYSOPER.

And you cannot revoke it:

SQL> revoke sysdba from sys;
revoke sysdba from sys
*
ERROR at line 1:
ORA-01998: REVOKE failed: user SYS always has SYSOPER
and SYSDBA

More information from the docs:

These administrative privileges allow access to a database instance even when the database is not open. Control of these privileges is totally outside of the database itself. Methods for authenticating database administrators with these privileges include operating system (OS) authentication, password files, and strong authentication with a directory-based authentication service.

These privileges can also be thought of as types of connections that enable you to perform certain database operations for which privileges cannot be granted in any other fashion.

and:

When you grant SYSDBA, SYSOPER, SYSBACKUP, SYSDG, or SYSKM administrative privilege to a user, that user's name and privilege information are added to the database password file. A user's name remains in the password file only as long as that user has at least one of these privileges. If you revoke all of these privileges, Oracle Database removes the user from the password file.

Best Answer

Related Solutions

Understanding oracle SCN

Oracle – How Does the SYS User Get SYSDBA Privilege?

Related Question