5.1 About the Defaults Those of you who are familiar with earlier versions of Oracle (before version 6) will remember that three privilege levels were defined before the concept of roles was introduced in version 6. Oracle used the same names for the new roles that were used for the privilege levels. These are CONNECT, RESOURCE, and DBA. Four more roles were added in version 7.1.6: SYSDBA, SYSOPER, EXP_FULL_DATABASE, and IMP_FULL_DATABASE; these roles did not exist as privilege levels in earlier releases. Several more default roles have been added in Oracle8: DELETE_CATALOG_ROLE, EXECUTE_CATALOG_ROLE, and SELECT_CATALOG_ROLE. The following list briefly describes how the default roles are used.  | There is one more default user group that exists in every database public . public is a user group that is really a quasi-role; every user who is created belongs automatically to the public group. public does not have a password and cannot connect to the database, and, like a role, cannot own objects. See the section "Grants to public" later in this chapter. | | - CONNECT
-
Allows users to log into the database, to create objects, and to perform exports. - RESOURCE
-
Grants users the privileges necessary to create procedures, triggers, and (for Oracle8) types within the user's own schema area. - DBA
-
Allows users virtually unlimited privileges. - SYSDBA
-
Allows users to connect to the database and remotely perform privileged actions like starting up and shutting down the database (basically equivalent to the DBA role). - SYSOPER
-
Allows users to connect to the database remotely and perform a limited set of privileged actions, including starting up and shutting down. - EXP_FULL_DATABASE
-
Allows the user to perform export activities on any object within the database and record the export activities to the data dictionary. - IMP_FULL_DATABASE
-
Allows the user to become a user so that the user's objects can be imported into the appropriate schema area. For Oracle8, the default roles include: - DELETE_CATALOG_ROLE
-
Allows the user to delete rows from the SYS.AUD$ table. - EXECUTE_CATALOG_ROLE
-
Allows the user to execute any exported packages listed in the recovery catalog. [1] [1] The recovery catalog is discussed in Chapter 12. - SELECT_CATALOG_ROLE
-
Allows the user to select rows from all exported recovery catalog views and tables. This role is granted to users who will not receive the DBA role but who must be able to view exported views and tables in the data dictionary. At first glance, the Oracle-supplied default roles may seem to supply an appropriate range of privileges; for development environments, they may indeed be appropriate. For production systems, however, we recommend that you not use the CONNECT and RESOURCE roles. We make this recommendation for the following reasons: -
Oracle may change the privileges assigned to a default role from one major release of the software to another -
Some privileges may be created to give lower-level users more freedom than they should have -
Privileges on which an application may be relying may disappear Any of these occurrences could create a dangerous situation for your site's security. We advise you to take the necessary time and effort from the beginning of system development to create roles and grant them only the access that is really required. In this way, you'll encounter fewer problems as future releases of the Oracle RDBMS are made available. None of the default Oracle roles allows access to any database objects other than those granted to public and the data dictionary views. However, as we'll discuss later, the DBA role is quite powerful and should not be granted to anyone who is not in a direct database administration position. | | The default Oracle roles convey only system privileges, not object privileges. | | As we mentioned at the beginning of this chapter, Oracle also creates several default user accounts. Prior to version 7.3, the only user account (besides the standard sys and system accounts) that could be considered a "default" user was the account scott , which was always authenticated with the password tiger . The scott account (named after an early Oracle developer whose girlfriend owned a cat named Tiger) is intended for training purposes such as: -
Demonstrating new Oracle Forms and Reports products -
Teaching SQL and SQL*Plus -
Testing the database to verify that the installation was OK -
Testing SQL*Net connections With the Oracle Enterprise Manager and Oracle8, several additional default user accounts are now created. The section "Default User Accounts" later in this chapter describes these accounts. |
