Oracle DBA needs root access to run Upgrade Scripts

[kozlow]

We are trying to find out what other shops have done to answer this age old problem....

Oracle requires root to run Install and Upgrade scripts.

We do not allow DBA to have root access, so we would need to run the scripts for them.

We where looking at SUDO, but not sure what commands the scripts might need since they are always different.

Could click the bit to "run as" root, but that would send red flags up during an audit....

What have you done at your facility to resolve the issue?

 

[Annihilannic]

This is a difficult one to solve... sometimes the easiest thing is just to run the Oracle root.shs when the DBA asks you to.

The problem is that the sripts change for every single Oracle patch, and they are writeable by the Oracle user; so a malicious DBA (not saying that there is such a thing!) could add any commands they liked to the root.sh and use sudo to run it.

At one site I worked for we built up a collection of sample root.shs for the various Oracle patches and wrote a wrapper to compare the one they were running with those in the collection (ignoring lines that were expected to vary); but this was difficult to manage with the frequency of Oracle patches and inconsistencies in installation locations, etc.

Annihilannic.

 

[kozlow]

I have heard the same all over... We are just going to have to come in with our dba's when installs and patches are added...

Thanks..