Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Database Security >> Database Security >> How To Block Super User In Particular Time.
        
(Message started by: Pete Finnigan on Aug 20^th, 2010, 11:09am)

Title: How To Block Super User In Particular Time.
Post by Pete Finnigan on Aug 20^th, 2010, 11:09am

Hey Guys...

I really found this website very helpful. But here this time i got stuck, I just simply want to know the way to block the "Super User" or "DBA " to access the Oracle Database.
Definitely their might be a way out for this. Is there any method at the time of installation of database we can provide the agreement date. So that after that date the user and the super user/DBA will not able to fetch/access the data from database.

Definitely their will be a way to resolve this...
It will be really appreciated if will get the solution for this.

Thanks in advance.

Best Regards
Vibhu

Title: Re: How To Block Super User In Particular Time.
Post by Pete Finnigan on Sep 2^nd, 2010, 9:48am

Hi Vibhu,

This is virtually impossible unless you rely on human processes as well. The users can be blocked effectively but you cannot block SYSDBA. You could block a user who is a lower level but a person who is a DBA. i.e. they do not have the ability to log on as SYS, oracle, osdba, SYSDBA in the database and also they do not have the ability to simply escalate their privileges back to that level.

The database privilege model needs to be well designed before you can apply technical solutions to block access.

It sounds from your description that you want to populate a database and then stop any changes, i.e. a fixed read only database?

If so then consider a standby database that can be opened readonly?

cheers

Pete