Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the security reason, I want to create the user and then assign the backup job to that user. This means that this user is not allowed to do anything else beside backing up the database.

However, as the Oracle documents says that user logged in to RMAN must have sysdba privilege. So as the sysdba, that user can perform many other database operations.

So, how can I create a user and assign only a specific backup job?



share|improve this question
As said in the Oracle documentation, RMAN can only be run with the sysdba privilege. Why is this a problem for you? – Benoit Aug 26 '09 at 9:17
Because this user can create or drop any objects in the database without restriction. – Sarith Aug 26 '09 at 9:19
up vote 1 down vote accepted

It seems you misunderstand what the sysdba privilege is and how it is managed: The SYSDBA privilege is needed to perform some operations (create/drop/alter database, start or stop an instance, ...). When you connect to a database using this privilege, it is as if you were connected as user "sys".

Due to the fact that the SYSDBA privilege is needed to startup the instance, the control of this privilege is manage outside the database, ie in a group at the OS level. This group is named "dba" on unix server or "ora_dba" on windows boxes. All the OS user accounts that are in this group are allowed to connect to the database with the sysdba privilege, even if they don't have an account inside the database.

And as said in the documentation RMAN must be run with the sysdba privilege. Indeed, this user is allowed to drop any objects in the database without restriction but this is because RMAN should be run only by a dba not by some random users.

If you want to allow a user to export some objects you will have to do otherwise. If you use oracle 10g or newer, have a look at datapump. With datapump, a DBA can choose a folder on the server, where some users could export some objects.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.