Re: DBAs, roles and privs

Pete Finnigan wrote:

> I am sorry I have to
> disagree with Daniel, just dropping privileges until something breaks is
> not a good plan. I have seen this done before and it results in chaos.

On rereading this ... I have to agree. I was thinking in terms of dropping privileges that, after investigation, seemed dangersous and irrelevant to the application. So, for example, I'd feel reasonably comfortable dropping ADMINISTER SECURITY or DROP TABLESPACE.

I did not mean to imply that I'd blindly go around dropping privs until I finally got to CREATE SESSION.

-- 
Daniel Morgan
http://www.outreach.washington.edu/ext/certificates/oad/oad_crs.asp
http://www.outreach.washington.edu/ext/certificates/aoa/aoa_crs.asp
damorgan_at_x.washington.edu
(replace 'x' with a 'u' to reply)