Re: Oracle security question

2003-07-15 Thread Don Yu
Ron, I have urgent question. Because I want to shutdown my database, I login as oracle and execute dbshut. But later I found that the process is very slow so I realize that I should type shutdown immediate. Then, I use control-D to stop shutdown command. And I re-execute shutdown immediate. Now

Re: Oracle security question

2003-07-15 Thread Ron Rogers
Don, A normal shutdown will wait for all of the users to complete there work and shutdown when the users are off the system. A shutdown immediate wait for the current transactions to complete and not allow any more to start before shutting down. A shutdown abort does just that, I stops all

Re: Oracle security question

2003-07-15 Thread Arup Nanda
I'm not Ron; but I'll take a stab at this. The shutdown immediate is hanging probably because there are several transactions that are rolling back. The database is not going to close till all have rolled back completely. HTH. Arup Nanda - Original Message - To: Multiple recipients of

Re: Oracle security question

2003-07-14 Thread Ron Rogers
Don, The users need acces to the data that is in the database or what is the purpose of the database? I would change the privileges of the users to CREATE SESSION only and revoke all others. Then I would use ROLES that have select privileges on the tables that they need acces to. By creating

Re: Oracle security question

2003-07-14 Thread Pete Finnigan
Hi Don, I wrote a paper for securityfocus.com a while ago that described a simple security scanner for Oracle, there is also a script you can run with the paper. You can get the link on my Oracle security papers page on my site at www.petefinnigan.com/orasec.htm, the paper is near the top and is

Re: Oracle security question

2003-07-14 Thread Don Yu
Dear Guang Mei: Thanks for your message. Your suggestion is very helpful. After reviewing all possible uesers, I have locked them. Now I have only one concern that if nobody knows my database's sys and system's password, there should be no way to unlock these accounts. Am I complete right?

RE: Oracle security question

2003-07-14 Thread DENNIS WILLIAMS
Don Well, if you changed the password, then you should have the new password. Don't post them, because everyone on the internet will have them. What is your Oracle version? Dennis Williams DBA, 80%OCP, 100% DBA Lifetouch, Inc. [EMAIL PROTECTED] -Original Message- Sent: Monday,

Re: Oracle security question

2003-07-13 Thread zhu chao
Hi, I suggest you use sqlldr to load the data into the database.In most case, sqlldr solves this kidn of questions. Second, as dennis said, read more about oracle. oracle Is pretty complicate, and it is hard to manage if you do not understand it. Besides dba 101, you can get free books

RE: Oracle security question

2003-07-12 Thread DENNIS WILLIAMS
Don Interesting web site. Well, I think you have enough information from us. Now it is just some detective work. The next subject you need to review is backup and recovery. Keep the information in those databases secure. Dennis Williams DBA, 80%OCP, 100% DBA Lifetouch, Inc. [EMAIL

Re: Oracle security question

2003-07-11 Thread Stephen Andert
Don, Look at dba_tab_privs. Stephen [EMAIL PROTECTED] 07/11/03 12:44PM Hi, I have a security question about Oracle database. Recently I have taken full control an Oracle database in my department. Now I would like to make sure that no other people except myself can update data in that

RE: Oracle security question

2003-07-11 Thread Stephane Paquette
Change the password of all Oracle related users (sys, system,...) Revoke access from all other users or make sure all other users have select only privilege on data. What is the use of such databases ? Stephane Paquette Administrateur de bases de donnees Database Administrator Standard Life

RE: Oracle security question

2003-07-11 Thread DENNIS WILLIAMS
Don If only you can make updates to your Oracle database, then you must enter all the data ;-) From the tone of your posting, I'm going to assume that you are pretty new to Oracle. You may want to get a good basic administration book like Oracle9i DBA 101.

Re: Oracle security question

2003-07-11 Thread Don Yu
Stephane, Thanks for your message. The reason I ask this question is that now I am responsible for creating some reports based upon this database. But I have found that there are unaccountable data in my database, which is not from my insert script or my cron job program. Thanks! Don Stephane

Re: Oracle security question

2003-07-11 Thread Don Yu
Dennis: Thanks for your message. Now I have changed sys password by the following command: alter user sys identified by xxx But when I try to login from sql plus window by using sys, I cannot successfully login. Also I get an error message. The message is something like connection to sys

RE: Oracle security question

2003-07-11 Thread DENNIS WILLIAMS
Don SYS is the owner of the Oracle dictionary tables. It is a username with DBA privilege, so someone who logs in can change data. If you have changed its password, then you are assured that nobody is using that username right now. If you've changed its password, then I wouldn't worry about

RE: Oracle security question

2003-07-11 Thread DENNIS WILLIAMS
Oops. I meant to say that you might consider changing the PASSWORD of the username that owns your tables. -Original Message- Sent: Friday, July 11, 2003 4:14 PM To: Multiple recipients of list ORACLE-L Don SYS is the owner of the Oracle dictionary tables. It is a username with DBA

Re: Oracle security question

2003-07-11 Thread Don Yu
Dennis Thank you very much. My data in that database is changed three times. The first is whole data being delete. The second is over ten thousands records being added. The third is whole data related to a month being deleted. I know my working environment is very complicated. For this report

RE: Oracle security question

2003-07-11 Thread Jacques Kilchoer
objects (like a public PLAN_TABLE or the PRODUCT_USER_PROFILE table.) -Original Message- From: Don Yu [mailto:[EMAIL PROTECTED] Sent: vendredi, 11. juillet 2003 13:49 To: Multiple recipients of list ORACLE-L Subject: Re: Oracle security question Dennis: Thanks for your message. Now

Re: Oracle security question

2003-07-11 Thread Guang Mei
select * from all_users; to get all users, then change their oracle passwords so that no body can log in except you. This way you know you are the only one who can change the data. Next step is see what application can make the data change. Hope this helps. Guang On Fri, 11 Jul 2003, Don