| revoke sysoper from userA when the parameter "remote_login_passwordfile" is set [message #64494] |
Wed, 02 February 2005 05:23  |
kalpin
Messages: 4
Registered: February 2005
|
Junior Member |
|
|
I know that When the parameter "remote_login_passwordfile" is set to "shared", we can not grant sysdba or sysooper priviledge to a user other than SYS. But at this time i can revoke sysdba or sysoper from a user who was granted these priviledges when the "remote_login_passwordfile" is "exclusive".Here is my experiments:
SQL>show parameter remote_login_passwordfile
NAME TYPE VALUE
------------------------------------ ----------- -----------
remote_login_passwordfile string EXCLUSIVE
SQL> select * from v$pwfile_users;
USERNAME SYSDB SYSOP
------------------------------ ----- -----
SYS TRUE TRUE
A FALSE TRUE
SYSTEM FALSE TRUE
SQL> alter system set remote_login_passwordfile=shared scope=spfile;
system altered
SQL> shutdown immediate
database closed
database dismounted
ORACLE instance shutdown
SQL> startup
ORACLE instance started
Total System Global Area 252779340 bytes
Fixed Size 453452 bytes
Variable Size 209715200 bytes
Database Buffers 41943040 bytes
Redo Buffers 667648 bytes
SQL> select * from v$pwfile_users;
USERNAME SYSDB SYSOP
------------------------------ ----- -----
SYS TRUE TRUE
SQL> revoke sysoper from a;
revoke succeeded
After i set the remote_login_passwordfile to "exclusive" again and restart the database,user A is still granted the sysoper priviledge, Why ? the revoke command didn't work,did it ?
SQL> select * from v$pwfile_users;
USERNAME SYSDB SYSOP
------------------------------ ----- -----
SYS TRUE TRUE
A FALSE TRUE
SYSTEM FALSE TRUE
I think that When remote_login_passwordfile is set to none or shared, Oracle should not give a "revoke succeeded" response after "revoke sysoper from a" command was executed, what it should give is "cannot revoke users from public password file" which is just like the error info after "grant sysoper to a" in "shared" or "none" mode.
|
|
|
|
| Re: revoke sysoper from userA when the parameter "remote_login_passwordfile" is set [message #289976 is a reply to message #64494] |
Wed, 26 December 2007 23:53  |
mkbhati
Messages: 93
Registered: February 2007
Location: Mumbai
|
Member |
|
|
There is a shift in behaviour for parameter REMOTE_LOGIN_PASSWORDFILE in 10g please see following in Oracle Database Reference 10R2 :
Parameter REMOTE_LOGIN_PASSWORDFILE
Property Description
Parameter type String
Syntax REMOTE_LOGIN_PASSWORDFILE= {NONE | SHARED}
Default value SHARED
Modifiable No
Basic Yes
RAC Multiple instances must have the same value.
REMOTE_LOGIN_PASSWORDFILE specifies whether Oracle checks for a password file.
Values:
NONE : Oracle ignores any password file. Therefore, privileged users must be authenticated by the operating system.
SHARED : One or more databases can use the password file. The password file can contain SYS as well as non-SYS users.
Note : The value EXCLUSIVE is supported for backward compatibility. It now has the same behavior as the value SHARED
|
|
|
|
|
|
|
|
] 
Blog
Search
Help
Members
Register
Login
Home
