[Previous entry: "Russian Oracle Security Book"] [Next entry: "Pre-Announcement - Oracle Security Training in York in 2010"]
Creating users creatively
November 12th, 2009 by Pete
Post to del.icio.us
Post to Furl
I saw a nice post on Alex Nuijten's blog yesterday titled "Create Users with DBMS_METADATA" via my Oracle blogs aggregator that talks about Alex's use of DBMS_METADATA to copy database users from one database to another by generating the DDL for user creations including all of the granted roles, system privileges and object privileges. This is an easy way to copy users and obviously beats the old ways of trying to derive this knowledge from the data dictionary yourself.
The reason I want to highlight this is really to emphasise the fact that there is more than one way to achive something in Oracle; This is important; its not just about creating users but about deducing the privileges and status of users in this case without directly selecting that detail from the dictionary. The simplistic view of security is to protect data (in this case meta-data) at source, a simplistic view would be to review the direct select privileges on SYS.USER$ or DBA_USERS and all the associated views and base tables such as DBA_SYS_PRIVS or DBA_ROLE_PRIVS or DBA_TAB_PRIVS but there are other ways to read data in this case by using DBMS_METADATA to get the same information. This post by Alex is useful is showing that there is more than one route to user details.
- there is still some way to go with basics of securing data; a lot of focus is on hacking, bugs, CPU's, exploits etc which is fine but some of the focus needs to be on the basics; default installs, passwords, data leaks, configuration.... i.e. all the bits we as customers of Oracle are responsible for.
November 13th, 2009 at 11:33 pm
joel garry says:
I'm still wondering if it is a great idea for OCM to spit out a world-readable list of all database users every day.