Nitin Singh/AAO RTI ALLAHABAD1 DATABASE SECURITY DATABASE SECURITY

Nitin Singh/AAO RTI ALLAHABADNitin Singh/AAO RTI ALLAHABAD 11

DATABASE SECURITYDATABASE SECURITY


OBJECTIVESOBJECTIVES

• What is Database security

• Creating user

• Modifying user

• Dropping user

• Creating profile

• Previliges and roles

• Granting of roles to user

33Nitin Singh/AAO RTI ALLAHABADNitin Singh/AAO RTI ALLAHABAD

Database SecurityDatabase Security

(a) Manage Users(a) Manage Users

(b) Manage Resource(b) Manage Resource

(c) ROLEs & PRIVILEGEs(c) ROLEs & PRIVILEGEs


CREATE USERCREATE USERCREATE USER test IDENTIFIED BY test DEFAULT TABLESPACE USERS TEMPORARY TABLESPACE TEMP PROFILE DEFAULT

QUOTA 1M ON USERS

QUOTA 2M ON TEMP;


Considerations Considerations

• Specify DEFAULT & TEMP• Otherwise SYSTEM tablespace will be

used, which is not recommended• Quota must be provided to allow user to

store objects in specified tablespace

• Profile to restrict usage of system resources


MODIFY USERMODIFY USER

• GRANT CONNECT TO TEST;

• ALTER USER TEST DEFAULT ROLE ALL;

• GRANT DBA TO TEST;

With DBA ROLE user gets an UNLIMITED QUOTA on every tablespace


Security IssuesSecurity Issues

• A USER is A SCHEMA

• A USER has FULL access on the OBJECTS in her SCHEMA

• Password is stored in Data Dictionary

• A USER can always CHANGE his Password


Dropping A UserDropping A User

• User’s Schema is removed from Data Dictionary

• Cannot Drop a Active User

• Use Cascade to Drop all Schema Objects


Resource Limit & ProfilesResource Limit & Profiles

• To optimize the usage of System Resources• Profile is a set of Resource Limits assigned to

each user• Resource Control Level

(a) Session Level(b) Call Level

• Resources : CPU time, Logical Reads, Others (Idle Time, No of concurrent sessions per user, Elapsed time per session )


CREATE ProfileCREATE Profile

CREATE PROFILE MYPROFILE LIMIT CPU_PER_SESSION 10 CPU_PER_CALL 25CONNECT_TIME 5 IDLE_TIME 1 SESSIONS_PER_USER 2;


Oracle ProfilesOracle Profiles• Profiles enable you to set limits on:

• sessions_per_user• CPU_per_session• CPU_per_call• logical_reads_per_session• logical_reads_per_call• idle_time• connect_time


Oracle ProfilesOracle Profiles• Most popular:

• sessions_per_user

• idle_time

• Sessions_Per_user– prevent one runaway user from consuming all Oracle

processes– Example syntax:

alter profile default sessions_per_user 4;

• Idle_Time– useful when memory is in shortage


PRIVILEGES & ROLESPRIVILEGES & ROLES

• Privilege is right to execute a particular type SQL or access another user’s object

e.g, the right to CREATE TABLE• SYSTEM Privileges (ALTER SESSION)

• OBJECT Privileges (INSERT ON

SCOTT.EMP)• GRANT privileges to USER or a ROLE

(named group of privileges)


CREATE ROLECREATE ROLE

CREATE ROLE test NOT IDENTIFIED;

GRANT “CONNECT” TO “TEST”;

GRANT ALTER ANY TABLE TO “TEST”;

GRANT INSERT ON SCOTT.EMP TO TEST;

Assigning

(a) ROLE to a ROLE

(b) OBJECT Privilege to a ROLE

(c) SYSTEM Privilege to a ROLE


DEFAULT ROLESDEFAULT ROLES

• CONNECT

• DBA (All System Privileges with Admin)

• RESOURCE

• EXP_FULL_DATABASE

• IMP_FULL_DATABASE

Query DBA_TAB_PRIVS, DBA_ROLE_PRIVS,SESSION_PRIVS


Listing User InfoListing User Info

• ALL_, DBA_, USER_ + USERS• USER_TS_QUOTAS• USER_RESOURCE_LIMITS• DBA_PROFILES• RESOURCE_COST• V$SESSION V$SESSTAT• V$STATNAME


ROLEs Granted to UserROLEs Granted to User

• SELECT * FROM SYS.DBA_ROLE_PRIVS WHERE GRANTEE = ‘SCOTT’;

(Roles Granted to SCOTT)

• SELECT * FROM SYS.DBA_TS_QUOTAS;

(Each User’s TS quotas)

Documents

Nitin Singh/AAO RTI ALLAHABAD1 DATABASE SECURITY DATABASE SECURITY