Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently using RHEL 5 and Oracle 11g.

I use DBCA to create Oracle database with all default options available. The problem is that when I create a new user on that database, this user can connect to the database with sysdba privilege although it is not granted any privileges.

create user backup_admin identified by password default tablespace users;

sqlplus backup_admin as sysdba

What to do to restrict the user from connecting as sysdba?

share|improve this question
    
Are you logged in to the operating system as the Oracle user (or a member of the DBA group)? –  Justin Cave Aug 26 '09 at 4:23
    
Yes, I log in to the OS as the Oracle user. –  Sarith Aug 26 '09 at 5:04

1 Answer 1

up vote 4 down vote accepted

"The problem is that when I create a new user on that database, this user can connect to the database with sysdba privilege although it is not granted any privileges."

Incorrect. Database users cannot connect as SYSDBA. Connecting as SYSDBA means connecting to the SYS user/schema.

OS users can connect as sysdba if, as Justin mentions, they are in the dba group. This normally includes the oracle user, but maybe others too.

Oracle is a bit misleading that you can try, for example, SQLPLUS user/pass AS SYSDBA In this case, the user/pass is ignored and it has the same effect as SQLPLUS / AS SYSDBA

share|improve this answer
    
It can be helpful to also try the login remotely. ie 'sqlplus /nolog' then 'connect backup_admin/password@tnsdatabasename as sysdba' You will probably find that this will not work as the OS level authentication mentioned above won't work for a remote connection. –  Cephas Aug 26 '09 at 4:59
    
Hi Gary, you are right. So how can I restrict the "SQLPLUS user/pass AS SYSDBA"? As u mention, it has the same effect as "SQLPLUS / AS SYSDBA". Regards, Sarith –  Sarith Aug 26 '09 at 5:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.