Re: OK to revoke privileges from SYS or DBA?

"Denis Do" <nospam.denisdo_at_yahoo.com> wrote in message news:slrncrd15j.j0.nospam.denisdo_at_denisdo.news.google.com...
> BTW, since we already started this topic - what would you, Anurag,
> recommend to do for getting "out of the box installation"
> reasonably secure? I really would like to know, please answer.
> Also it will be good for others, and that can be kind of "What is
> right thing to do" advice.

http://www.petefinnigan.com/orasec.htm would be an excellent place to start.

> From my side, I would recommend (as DM did) do not use well -known roles
> and accounts, create in your DB only those components, you really need and
> never use DBCA.

Why would you never use DBCA? At least to generate the initial scripts.

I'm also intrigued by your suggestion that once the database goes live you should never touch anything again. Oracle patches exist for a reason - security is one of them. If you *really* have dumped half the data dictionary then almost certainly your db cannot be patched and is likely less secure than if you'd followed sensible industry standard practices.

-- 
Niall Litchfield
Oracle DBA
http://www.niall.litchfield.dial.pipex.com