Grant, view, and manage user permissions in Oracle (3)

Oracle users are divided into system and object permissions based on the granted permissions. The highest permission is sysdba. Sysdba has the privilege to control all behaviors of Oracle, such as creating, starting, closing, and restoring databases, so that databases can be archived or not archived, backup tablespace and other key actions can only be performed by users with sysdba permissions. These tasks do not work even for common DBA roles. Sysoper is a permission similar to sysdba, except that SYSOPER privileges with admin option, create database, and recover database until are less than sysdba. The two authentication methods are the same, so the following describes only the authentication management of sysdba.
There are two methods to manage sysdba: *** system authentication and password file authentication. The specific authentication method depends on whether you want to maintain the database on the machine running Oracle or manage all the Oracle databases distributed on different machines on one machine. If you choose to maintain the database on the local machine, selecting ** for system authentication may be a simple and easy way. If you have many databases and want to perform centralized management, you can select the password file authentication method.
The following describes the trade-off process:
The configuration process using *** for system authentication:
1. Create a valid account in the *** system.
Specifically, on NT, first create a local user group named oraw.dba, where SID is the SID of the database instance, or create an ORA_DBA group, this group does not apply to any separate Oracle instance. In this way, when an NT has several Oracle instances, you do not need to manage them separately. Create a user on NT and add it to the group. However, these two steps have been completed automatically during the Oracle8I installation process. Generally, you do not need to perform them manually.
Step 3: In sqlnet. ora (located in the $ ORACLE_HOME/NETWORK/ADMIN directory. AUTHENTICATION _ SERVICES is set to SQLNET. AUTHENTICATION_SERVICES = (ETS), which means to use the NT authentication method.
Step 4: In init. ora, set remote_login_password to none, meaning password authentication is not required.
After completing the preceding steps, you can directly connect internal (connect/As sysdba) in SQL * Plus and Server Manager to log on to Oracle as a Super User after logging on to NT, execute *** tasks that can only be performed by Super Users.
In UNIX, the situation is somewhat different. After all, this is a completely different *** operating system.
First, create a DBA group before installing oracle. This step is not required. Otherwise, Oracle cannot be installed. Generally, a user named oracle is created and added to the DBA group.
Step 2: Set remote_login_password to none. After oracle8.1, this parameter is exclusive by default. Remember to change it.
Step 3: log on to UNIX with the user name, run SQL * Plus or Server Manager, and enter the following command: connect internal (connect/As sysdba) to log on to Oracle.

To use the password file for authentication, follow these steps:
Oracle provides the orapwd utility to create a password file. The specific steps for using orapwd to establish this authentication method are as follows:
1. Use the orapwd utility to create a password file. Syntax:
Orapwd file = file name Password = internal user password entried = entries.
Explanation:
The file name must contain the complete full path name. If not specified, Oracle places it under $ ORACLE_HOME/DBS (UNIX) or $ ORACLE_HOME/Database (NT) by default.
The user password is the user's internal password. Of course, you can add other super users to it later.
Entries indicates the maximum number of Super Users Allowed. This is optional. The first two must be specified. It is usually set to be larger than the actual needs, so as not to be insufficient.

2. Set REMOTE_LOGIN_PASSWORD in INIT. ORA to EXCLUSIVE or SHARED. Use EXCLUSIVE to use this password file only for the current INSTANCE. In addition, other users are allowed to log on to the system as sysdba. If SHARED is selected, it indicates that more than one instance uses this password file, with a strong constraint: sysdba permissions can only be granted to sys and internal. (In fact, internal is not a real user, but sys is an alias for sysdba logon .)
Remember to set sqlnet. AUTHENTICATION _ SERVICES to NONE in the SQLNET. ora file. It is usually set by default in Unix. In NT, if you select a typical installation, OS authentication is used, and password file authentication is used for custom installation. During installation, an INTERNAL password is prompted. In this way, you do not need to manually create a password file or set an INTERNAL password.

3. Run the following command in SQL * Plus or SERVER MANAGER to log on to the system: CONNECT INTERNAL/password.