Re: DBAs running

From: Austin Hackett <>
Date: Mon, 03 Feb 2014 18:05:17 +0000
Message-id: <>

Thanks Niall.

Yes, the SA concern is that someone with access to the oracle OS account (DBA or attacker) can add arbitrary commands of their choosing to and run them as root.

I totally agree with you - a DBA or attacker with "oracle" access on a DB server can do some pretty serious damage without resorting to edits on!

On 3 Feb 2014, at 17:42, Niall Litchfield <> wrote:

> I think the SA's argument is this.
> is an executable shell script owned by oracle and therefore modifiable by oracle - a non-privileged user could therefore use as an attack vector against the server. This is, as far as I can tell, correct. Whether it is any more of a threat than the dba being able to run arbitrary code with the privileges that the oracle account has seems unlikely to me. I'd probably suggest a round table meeting between the O/S, DBA and Security subject matter experts to agree a solution..
> As the scripts generated contain the ORACLE_HOME path in them I think the suggested approach likely to be problematic, clearly one could edit (and all the scripts that it calls nowadays) to take, say, $ORACLE_HOME as an argument and then have an authorized central repository of them, good luck with the support ticket when something is missed though.
> Interesting question Austin.

Received on Mon Feb 03 2014 - 19:05:17 CET

Original text of this message