Printable View
Hi,
We have users requesting access to SYS.
Even though it is on a development database, we think users should not be allowed to log in as SYS.
Can anybody give me valid reasons why users should not have SYS access so I can present them with this?
If I am wrong, and you think this is OK, please let me know.
Thanks for your help
If you are the DBA it should be the users who need to justify thier need to have access to the SYS account, not the other way round!
If developers need access to particular SYS objects the DBA should grant that privilege. It is the only way you will maintain control of the system.
Regards
You could always grant DBA to their account. (Of course, I'd recommend against this...)
I hardly see why a user would like to connect as sys...
There may be needs to connect as system, or at least to be granted select right on some system objects, but nothing more !
I guess you want to practice your recovery techniques!!Quote:
Originally posted by DQuinn
Hi,
We have users requesting access to SYS.
Even though it is on a development database, we think users should not be allowed to log in as SYS.
Can anybody give me valid reasons why users should not have SYS access so I can present them with this?
If I am wrong, and you think this is OK, please let me know.
Thanks for your help
Ask them exactly what they want to do and then decide if it is do-able. Why even let them get used to having the keys to the castle if it is NEVER going to happen in production.
Remember the horse goes before the cart,
The lunatics should not run the asylem,
USER is a 4 letter word, ect...
MH
Users should never need the sys or system passwords. If the database is setup properly (Permissions/synonyms, etc...), they should never need or ask for that access...
What's next - User's requesting root(Unix) or Administrator (Windows)?
You could tell them but then you'd have to kill them.
:D
I had this problem from developers who wanted to install something from a CD that required a sys password. For example, if they working on an application called RMS 9.0 and would like to apply the latest patch.
The solution is - either the DBA installs the application patch
or he changes the sys password TEMPORARILY for their install to go through and change it back once the install is complete.
For example change sys password to kris and change it back after an hour or so.
Alapps,
Actually, one of the users asked me if she could have the password to our unix oracledba password !!!
Shoot them, put 'em out of your misery!
Users, jeez
MH
You dont want to give them the sys password. A good "politically correct" way of saying it would be that you do not want any user to create user objects in the sys schema, thus, you cannot give it to them.
Better still, question them till they get fed up and stop asking for it.
-Chintz
I still say shoot them!
just ask, you are the DBA or I am the DBA?
Write a packaged procedure to do the job for them and grant execute access to them. The procedure will run with owner rights (by default) allowing them to perform the action as if they were SYS, but what they do will be limited by the procedure you code.
Cheers
Tim...
PS. I'm with Mr Hanky! Shoot them :)
Mine being a small company i have faced this problem and finally gave up trying.
The reason given by my manager is that sometimes if i am not there the other developers might need to bounce the database for some reason or if the database crashes and if i am not there then how will they get oracle support if they dont have the passwords etc etc.
actually I REALLY WANT TO SHOOT THEM.
Quote:
Originally posted by ronnie
Mine being a small company i have faced this problem and finally gave up trying.
The reason given by my manager is that sometimes if i am not there the other developers might need to bounce the database for some reason
write some script so that you can start up and shutdown the database
or if the database crashes
They cannot do anything about it
and if i am not there then how will they get oracle support if they dont have the passwords etc etc.
What password ??
actually I REALLY WANT TO SHOOT THEM.
Q: How do you know if a USER is lying?
see below...
A: His mouth is moving!!
:p
Shoot 'em!!
MH
http://www.vtcowboys.com/shoot.gif
Who ever needs the password please come in line....
It is us DBA's vs. them DAMN DEVELOPERS..
I still recall when I was a DBA at this big company.. The development team lead is to climb and sh*t all over the dba's heads.. that is to put it mildly..
He used to page me at 8pm.. to do a production migration urgently.. and then I migrate a little pro*c program.. it does not work obviouly.. ok.. I migrate again.. it does not work.. this goes on till 3am..
DAMN DEVELOPERS...
Our solution was the password in a sealed envelope in the safe in the CEO's office and a signout procedure (make a BIG deal of it). Things have to get bad before they ask him . . .Quote:
Originally posted by ronnie
The reason given by my manager is that sometimes if i am not there the other developers might need to bounce the database for some reason or if the database crashes and if i am not there then how will they get oracle support if they dont have the passwords etc etc.
Recommend NOT shooting them - it is impossible to get the blood out of the keyboard. Poison them, or better "Do it not with poison, strangle them, even on their own desks which they have contaminated" (appologies to WS).
One Funny way is
Give them password and change it as soon as they going to their desk :)
Again change it to same when they are apporching your desk for complaining
Show them you can connect through same password to system So Problems is ur computer not willing to take DBA Responsibilites
Just Give Big Smile And Go back to your Work :D :D :D :D :D :D
Viraj
--------
9i OCP DBA
Give them the password. Shutdown the database. Pretend that something terrible has happened to the database because of their sys access, take a nap :o, make them wait for hours :), startup and say you fixed it. :cool:
Needless to say, they will not ask for sys password again.:D
Hey I'm a Damn Developer and I have the sys password. :D :D :DQuote:
Originally posted by newbie5
It is us DBA's vs. them DAMN DEVELOPERS..
I still recall when I was a DBA at this big company.. The development team lead is to climb and sh*t all over the dba's heads.. that is to put it mildly..
He used to page me at 8pm.. to do a production migration urgently.. and then I migrate a little pro*c program.. it does not work obviouly.. ok.. I migrate again.. it does not work.. this goes on till 3am..
DAMN DEVELOPERS...
If someone needs to bounce a db give them sysoper privileges. I can't imagine why someone would want to create objects in the sys schema. I would find out what they want to do and find a way to help them without giving away the password.
That's a shame, I'm going to miss you around here.Quote:
Originally posted by gandolf989
Hey I'm a Damn Developer and I have the sys password.
Where is my gun?
MH
Mr. Hanky, the gun slingin' poo.Quote:
Originally posted by Mr.Hanky
That's a shame, I'm going to miss you around here.
Where is my gun?
MH
:D
I'm glad you smiled when you said that.
MH