Kevin makes a fair point. I don't know about other shops, but our
production database servers are dedicated to being database servers.
The only users who are given logins are sysadmin and dba. I can't think
of any valid reason that anyone else would need login access on a
production database server. If you limit the users who have access to
the servers at all, then you really don't have to worry about the myriad
of possible local attacks.
-Mark
--
Mark J. Bobak
Senior Oracle Architect
ProQuest Information & Learning
There is nothing so useless as doing efficiently that which shouldn't be
done at all. -Peter F. Drucker, 1909-2005
________________________________
From: oracle-l-bounce_at_freelists.org
[mailto:oracle-l-bounce_at_freelists.org] On Behalf Of Kevin Closson
Sent: Thursday, February 08, 2007 4:00 PM
To: freelists
Subject: RE: Using DD to Read Data from Oracle Datafiles
If you are worried about a user getting to the dd(1) command, you should
probably worry about then compiling C (libc), or having shell access at
all, no?
________________________________
From: oracle-l-bounce_at_freelists.org
[mailto:oracle-l-bounce_at_freelists.org] On Behalf Of rjamya
Sent: Thursday, February 08, 2007 12:39 PM
To: naqimirza_at_yahoo.com
Cc: Oracle-L @ freelists.org
Subject: Re: Using DD to Read Data from Oracle Datafiles
So,
You can make sure that
1. any normal user can't get to the raw (or cooked) datafiles.
2. They don't have access to 'dd' command
in addition to whatever else that you are doing.
--
http://www.freelists.org/webpage/oracle-l
Received on Thu Feb 08 2007 - 15:12:32 CST
