Re: starting Oracle from a account that has administrative privilege and a member of ora_dba group

From: Frank <fvanbortel_at_netscape.net>
Date: Thu, 13 Feb 2003 21:00:26 +0100
Message-ID: <3E4BF95A.4080603@netscape.net>

Howard J. Rogers wrote:
> On Wed, 12 Feb 2003 19:41:57 +0100, Frank wrote:
>
>

>>I have seen many installations of 8i, where sysdba had to be granted
>>explicitly to sys and system - and there's no way to do that, other than
>>using svrmgrl.

>
>
>
> Interesting. SYS always has the SYSDBA privilege, right after database
> creation, and it definitely didn't/doesn't need to be granted explicitly.
>
> SYSTEM, incidentally, never should have the SYSDBA privilege granted to
> him.
>
> From time immemorial, any connection as SYSDBA (or INTERNAL in earlier
> versions) routed you through to the SYS schema anyway. That is, assuming
> you did the wrong thing and granted SYSDBA to SYSTEM, then if you did:
>
> connect system/manager as sysdba
> show user
> SYS
>
> Or if you granted SYSDBA to Fred:
> connect fred/blogs as sysdba
> show user
> SYS
>
> Which is why SYS doesn't need the explicit grant.
>
> Regards
> HJR
>
>
>
>

>>Other than that, the OP seemed familiar with svrmgrl...

>
>

Well, 8i R3 on W2K needed it... 'Not enough privileges' if I didn't and tried to shut the database... No problems after granting SYSDBA to SYS.

And sys was also internal:

Oracle8i Enterprise Edition Release 8.1.7.4.1 - Production With the Partitioning option
JServer Release 8.1.7.4.1 - Production
SVRMGR> connect internal
Password:
Connected.
SVRMGR> select user from dual;
USER

---

SYS
1 row selected.
SVRMGR> But, surprisingly (well, to me at least): SVRMGR> revoke sysdba from sys;
revoke sysdba from sys
*
ORA-01998: REVOKE failed: user SYS always has SYSOPER and SYSDBA

Have I got versions mixed up, or did something change with one of the last patches? I will monitor - still have clients on 8iR2, and 8.1.7.1...

-- 
Regards, Frank van Bortel

Received on Thu Feb 13 2003 - 14:00:26 CST