Lesson 5 Administrative Users

Transcription

1 Administrative Users 5.1 Lesson 5 Administrative Users A practical and hands-on lesson on creating and using Oracle administrative users. SKILLBUILDERS

2 Administrative Users 5.2 Lesson Objectives Understand the purpose and power of the SYS and SYSTEM users Understand, use and grant the SYSDBA privilege Understand, use and grant the DBA role Make local (non-network) connections to the database Create new users with privileges necessary to perform startup/shutdown 5.2 In essence, this lesson answers the question, "What is an administrative user?". You will learn about the supplied users (SYS and SYSTEM), common administrative privileges, connecting to the database as an administrator and creating new administrators. Let s get started

3 Administrative Users The SYS User Protect the SYS user! SYS is created with CREATE DATABASE Owns data dictionary Has DBA role and SYSDBA privilege Password set at database creation Caution: Any user with ALTER USER privilege can change password Very rarely need to login to SYS Don t use for day-to-day admin tasks SQL> connect sys/class as as sysdba Connected. Must login 'as sysdba The CREATE DATABASE command creates and defines the password for two administrative users: SYS and SYSTEM. (We will study CREATE DATABASE in the lesson Creating a New Database later in this course.) SYS is an administrative user (i.e. by default it has been granted the DBA role and the SYSDBA privilege) but SYS is also very special. It owns the Oracle data dictionary tables and views. For example, SYS.OBJ$ and DBA_TABLES. In part because of this, we are better off not using SYS for our day-to-day administrative tasks (we might drop a critical dictionary object and corrupt the database). It is easy to create additional users and grant proper administrative privileges to them. The password for the SYS user is defined on the CREATE DATABASE command. Use caution when granting ALTER USER privilege; any user with ALTER USER privilege can change the password and login to SYS. When logging in with SYS, you must supply the AS SYSDBA keywords. Note that SYSDBA cannot be revoked from SYS. We ll discuss the meaning of SYSDBA later in this lesson. Supplemental Notes The CREATE DATABASE command actually executes a script called SQL.BSQ. In this file you will find two CREATE USER commands, one for SYS and one for SYSTEM. Do Not Change The Contents Of This File.

4 Administrative Users 5.4 The SYSTEM User Created with CREATE DATABASE Standard administrative user Granted DBA role Usually granted SYSDBA privilege too Requires "password file" More later Password set at database creation Caution: Any user with ALTER USER privilege can change password Protect the SYSTEM user! 5.4 The SYSTEM user is the standard, default administrative userid created at database creation time. SYSTEM is by default granted the DBA role (more on this later in this lesson) and, in most environments, the SYSDBA privilege. The password is set on the CREATE DATABASE command.

5 Administrative Users 5.5 SYSDBA 5.5 SYSDBA is an all-powerful administrative privilege Has privilege to start and stop database SYSDBA is the "startup/shutdown" privilege Contains all system privileges For example, CREATE TABLE, ALTER USER, CREATE DATABASE Must explicitly specify in logon Required if instance is idle SQL> connect system/dave as as sysdba Connected. SQL> show user USER is is "SYS" Any objects created will be owned by SYS SYSDBA is a special administrative privilege. More accurately, it is a group of privileges though not technically a role. (We will learn more about roles in the Managing Security lesson later in this course.) SYSDBA contains, among other privileges, the privilege to startup and shutdown the database. (For those learners who have used previous versions of Oracle, note that the "INTERNAL" connection was desupported as of Oracle9i.) User SYSTEM has SYSDBA privilege by default. (So does SYS, but, since SYS owns system objects like the data dictionary, it is best not to use SYS use SYSTEM.) The unique thing about SYSDBA is that you must explicitly specify "AS SYSDBA" in the connect string for the privilege to be active during the session. This is demonstrated in the example above. Notes for this slide continue on the next page

6 Administrative Users 5.6 Continued from the previous page: After connecting with / AS SYSDBA or userid AS SYSDBA, you will be operating in the SYS schema (even if the user name is, for example dave ). This means that if you create a table with CREATE TABLE X, the fully qualified table name will be SYS.X. Here is a complete list of privileges within the SYSDBA privilege: SYSDBA Privileges All system privileges with the ADMIN option CREATE DATABASE privilege Time-based database recovery Startup and Shutdown privileges (SYSOPER privilege also has this privilege*) Mount or open database (SYSOPER privilege also has this privilege) Backup database (SYSOPER privilege also has this privilege) Initiate archival of redo logs (SYSOPER privilege also has this privilege) Database recovery (SYSOPER privilege also has this privilege) Altering database to RESTRICTED SESSION mode (SYSOPER privilege also has this privilege) *SYSOPER is a restricted, scaled-down version of SYSDBA. SYSOPER Privileges startup/shutdown Mount or open database Backup database Initiate archival of redo logs Database recovery Altering database to RESTRICTED SESSION mode

7 Administrative Users DBA Role Role is a collection of privileges Oracle supplies DBA role for convenience Contains all system-level privileges CREATE TABLE, CREATE USER, etc. Can administrate all system privileges For example, can revoke CREATE TABLE from anyone Cannot startup or shutdown database Need SYSDBA for that Note that Oracle recommends creating your own administrative roles Does not guarantee availability of DBA role in future Oracle provides several predefined roles (collections of privileges) for our convenience. One of these roles is the "DBA" role. The DBA role is, by default granted to the SYS and SYSTEM users. It contains all system-level privileges (e.g. CREATE TABLE) with administrator rights. An administrator of a privilege can grant or revoke the privilege to and from any user even a user who granted you the privilege in the first place. You truly are "an administrator of the privilege." We will study privileges in more detail in the Managing Security lesson later in this course. Note that the Oracle9i SQL Reference manual (see the GRANT statement) recommends that you create your own administrator role and warns that the DBA role may not be supported in future releases.

8 Administrative Users 5.8 Local Connections SQL> SQL> connect / as as sysdba Connected. SQL> SQL> show show user user USER USER is is "SYS" "SYS" SQL> SQL> shutdown Database closed. Database dismounted. ORACLE instance shut shut down. down. OS user can connect AS SYSDBA Without Oracle password! Must be part of Unix ORA_DBA group Windows users manage with Control Panel facility 5.8 If you are connected locally to the server (either you are sitting in front of the server or you are Telnet ed into it), and your operating system (OS) user is in the operating system ORA_DBA group in Unix (or Linux) or has administrative privileges in Windows (check Control Panel / Users and Passwords), you can login without an Oracle password. The AS SYSDBA syntax is required as shown above. You can actually connect with any userid, since the AS SYSDBA will always connect you as SYS (SHOW USER in SQL*Plus will display SYS when you connect to any userid AS SYSDBA). As the example demonstrates, a local user connected as SYSDBA can shutdown the database. The user can also start the database with the STARTUP Command. We will study the STARTUP and SHUTDOWN commands in the Startup and Shutdown Instance lesson later in this course.

9 Administrative Users 5.9 Remote Connections Connecting AS SYSDBA over network is supported SQL> connect as as sysdba Connected. SQL> 5.9 Remote SYSDBA connections require password file If you need to login remotely, you will need to create a password file and specify the host string and AS SYSDBA as shown in the example above. The host string is defined in the following file: $ORACLE_HOME/NETWORK/ADMIN/TNSNAMES.ORA Host strings will be discussed in more detail in the lesson entitled Introduction to Oracle Networking later in this course. Turn to the next page for a discussion of password files.

10 Administrative Users 5.10 Creating a Password File Password file required To connect AS SYSDBA over a network Which allows remote startup/shutdown To grant SYSDBA and SYSOPER to other users Errors returned if missing Three steps to implement: Create password file Set REMOTE_LOGIN_PASSWORDFILE database parameter Bounce database 5.10 Before we cover the details regarding creating password files, let s review from the lesson on Architecture: Password files are operating system files used by Oracle to authenticate administrative users (SYSDBA) attempting to connect over a network. Most databases especially those created with the Oracle Database Configuration Assistant (DBCA) already have a password file. However, if your database does not have a password file or you need to recreate the file, three simple steps are required. Errors will be returned if you attempt operations that require a password file. For example, attempting a remote connection as SYSDBA: SQL> connect system/dave@laptop as sysdba ERROR: ORA-01031: insufficient privileges Notes continue on the next page

11 Administrative Users 5.11 Or for example, attempting to grant SYSDBA to a user: SQL> grant sysdba to dave 2 / grant sysdba to dave * ERROR at line 1: ORA-01994: GRANT failed: cannot add users to public password file Looking at the setting for the REMOTE_LOGIN_PASSWORDFILE initialization parameter reveals that a password file is not being used: SQL> show parameter remote_login_passwordfile NAME TYPE VALUE remote_login_passwordfile string NONE

12 Administrative Users 5.12 Creating a Password File 5.12 SQL> $orapwd file=c:\oracle\ora92\database\pwddave.ora password=class entries=25 SQL> alter system 2 set set remote_login_passwordfile=exclusive 3 scope=spfile; System altered. SQL> shutdown ORACLE instance shut down. SQL> startup Three steps are required to create (or recreate) and implement a password file: Create the password file with the ORAPWD utility. This is an operating system utility. Note in the example above the command is prefaced with a dollar sign (synonym for the HOST command) to send the command to the operating system. The location (path) and file name are specific and fixed you must use the proper location for your server and operating system. For a Windows environment, use: $ORACLE_HOME\DATABASE\PWDINSTANCE_NAME.ORA The password becomes the password for the SYS user. The "entries" parameter specifies the maximum number of users that can have the SYSDBA privilege. You will need to recreate the file if this is exceeded. Set the REMOTE_LOGIN_PASSWORDFILE initialization parameter to "exclusive". The example above accomplishes this by changing the server parameter file (SPFILE) with the ALTER SYSTEM command. Don t worry about the details of this command now; we will cover this in detail later in the lesson Initialization Parameter Files. Lastly, in order for the change to the server parameter file to take effect, you will need to stop and restart the database.

13 Administrative Users 5.13 Password File Entries SQL> select * from v$pwfile_users; USERNAME SYSDB SYSOP SYS SYS TRUE TRUE SQL> grant sysdba to to system; Grant succeeded. SQL> select * from v$pwfile_users; USERNAME SYSDB SYSOP SYS SYS TRUE TRUE SYSTEM TRUE FALSE 5.13 View shows who has SYSDBA privilege You can check the contents of the password file and thus see who has SYSDBA privilege by querying the V$PWFILE_USERS view. The example above also demonstrates that by granting SYSDBA to user SYSTEM, we are actually adding an entry to the password file.

14 Administrative Users 5.14 Create New Administrators Create a new user SQL> connect system/dave as as sysdba Connected. SQL> create user gary identified by by gary; User created SQL> grant dba, sysdba to to gary; Grant succeeded. SQL> connect gary/gary Connected. SQL> connect gary/gary as as sysdba Connected. Grant administrator privileges Connect as a DBA Connect AS SYSDBA to start or stop database Creating additional administrative users is reasonably simple: Login with an existing administrative userid. Use an AS SYSDBA connection if you want to grant the new user SYSDBA privilege. Use the CREATE USER command to create the user and set the password with the IDENTIFIED BY clause. Grant the user privileges. This example grants DBA for general day-to-day administration tasks and SYSDBA so that the user can startup and shutdown the database. Note that both the DBA role and the SYSDBA privilege have the ability to connect to the database (i.e. they have CREATE SESSION privilege). The example demonstrates that the user can connect as SYSDBA or without SYSDBA.

15 Administrative Users 5.15 Administrative Users Workshop Administrative Users 5.15 Administrative Users Workshop 1. Login to Oracle with the SYS user. 2. Login to Oracle with SYSTEM user with the SYSDBA privilege. 3. Execute the SHOW USER command. What user is returned? 4. If you are working with a local connection to your Oracle server, login to the database with a local operating system connection. If problems occur, check which OS users are part of the ORA_DBA OS group. If you have only a remote connection, connect as necessary and go on to the next step. 5. Determine which users have been granted SYSDBA. 6. Create a new user. Use your first name as the user name and password. Workshop continues on the next page

16 Administrative Users 5.16 Workshop continued from the previous page 7. Grant SYSDBA to the new user. 8. Attempt to connect to the new user without the SYSDBA privilege. What happens? 9. Attempt to connect to the new user with the SYSDBA privilege. What happens? 10. Grant the DBA role to the new user. 11. Connect to the database with the new user without SYSDBA