July 6, 2008 05:58pm pdt

1. schwertner 7,100
2. sdstuber 5,200
3. dbmullen 4,600
4. omarfarid 4,000
5. aiklamha 2,680
6. rolutola 2,400
7. gnar 2,000
8. johnsone 1,700
9. Sqaimes 1,600
10. jinesh_k... 1,050
11. twoboats 1,000
12. laneduncan 800
13. kkrans 672
14. andyalder 664
14. Network_... 664

1. schwertner 9,100
2. sdstuber 5,200
3. slightwv 4,600
3. dbmullen 4,600
5. omarfarid 4,000
6. aiklamha 2,680
7. rolutola 2,400
8. gnar 2,000
8. yuzh 2,000
10. angelIII 1,700
10. johnsone 1,700
12. Sqaimes 1,600
13. sujith80 1,260
14. sapnam 1,200
15. jinesh_k... 1,050

02.28.2007 at 03:55AM PST, ID: 22418396

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.4

pros and cons assigning default roles to connect,resource to new users

Zones: Oracle 7.x, Oracle Product Info, Oracle 9.x

Tags: cons, oracle, pros, role

Hello expert,

I reading the book beginning oracle programming publish by wrox

And the authors advocate that it is big security risk to assign

Connect and resource roles to a user because of the elevated privileges assign to

these default roles.

Could any expert care to comment on the pros and cons of

assign default roles

Thanks

Start your free trial to view this solution

Question Stats

Zone: Database

Question Asked By: jomfra

Solution Provided By: sujith80

Participating Experts: 2

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

02.28.2007 at 04:52AM PST, ID: 18624384

Rank: Master

sujith80:

In 10g: these roles have following privileges.

CONNECT : CREATE SESSION
RESOURCE : CREATE CLUSTER, CREATE INDEXTYPE, CREATE OPERATOR, CREATE PROCEDURE, CREATE SEQUENCE, CREATE TABLE, CREATE TRIGGER and CREATE TYPE

In the previous versions CONNECT used to have a lot of extra privileges, like alter session. That could be manipulated in undesirable ways. (Not sure how that can be a security threat though.)

Still, its always better to grant individual privileges to the users, coz the DBA can decide what each user should do and what each user should not.

Accepted Solution

02.28.2007 at 06:08AM PST, ID: 18624958

dotten:

With the CONNECT role before you were given the ability to create and destroy objects of your own. In 10g they stripped the role to only allow it to connect to the DB but do nothing else. You would leverage this by ONLY granting EXECUTE privs as necessary to specific applications. That way, someone very slick at reading URL's could not destroy data because of the dumb idea of using the DB application owner as the account to connect with and retrieve data on behalf of the end user.

Now in 10g, most of those privs are embodied in the RESOURCE role.

Assisted Solution

02.28.2007 at 06:35AM PST, ID: 18625189

Rank: Master

sujith80:

dotten,

If the infrastructure allows users other than DBAs to connect to the database using sqlplus, then there is no point in talking about security issues in that implementation. Anybody can do anything.
Generally, OS level access to the machine where the db server is running will be controlled, Sql*Plus will be disabled, and the nodes that can connect to a database will be strictly controlled. Such a setup ensures that only a DBA who has proper access to the OS(makes more relevance in UNIX os) can only access the database directly.
Still, the oracle account you are using in your application programs should have all the privileges to create/destroy/manipulate data and do whatever it is supposed to do.

02.28.2007 at 07:30AM PST, ID: 18625771

dotten:

If you upgraded from a previous version of the database and your applications relied upon the create priviledges that were available in CONNECT, then there is a script provided for you by Oracle to restore them. It can be found in $ORACLE_HOME/rdbms/admin. It's name is rstrconn.sql

02.28.2007 at 08:48AM PST, ID: 18626568

jomfra:

hello experts

thanks for explanations

will go ahead and split the points

02.28.2007 at 09:27AM PST, ID: 18626913

dotten:

sugith: Here it is right out of the documentation from Oracle's docuumentation:

The CONNECT role was introduced with Oracle Database version 7, which added new and robust support for database roles. The CONNECT role is used in sample code, applications, documentation, and technical papers. The CONNECT role was established with the following privileges :
Privileges Originally Associated       with the CONNECT Role
Alter Session        Create Session
Create Cluster        Create Synonym
Create Database Link        Create Table
Create Sequence        Create View

In light of this fact, your assertion that 'anyone can do anything' is incorrect. Anyone can do most anything, but ONLY in their own schema. If these privs had the keyword 'ANY' in them, then they could do anything anywhere depending upon. I understand your point regarding sqlplus access being disabled at the server terminal, but what of the sqlplus client on a rmote machine?

The whole purpose of stripping the CONNECT role in 10g is to do exactly what I am indicating in my post above. The development environment is one thing, but using the object owner of the DB application objects as the DB account to retrieve data on behalf of web user going through a web tier opens you up to the possibility of some VERY slick people who can manipulate URL's to truncate, alter, drop objects because you are using the owner instead of a user that is only allowed execute on the packages.

I've seen it happen. I've even done it to clients who wanted a top to bottom assessment of an app before it gets turned out. The development teams, DBA's, and managers complained and some even refused to do it, until I went in and destroyed their application just manipulating the web URL the right way. THey changed their minds pretty quick.

02.28.2007 at 09:29AM PST, ID: 18626926

dotten:

second paragraph correction........'they could do anything anywhere depending upon which privs had the ANY keyword added to them.

20080236-EE-VQP-29