Read-only administrator... possible?

[kempis555]

I've got a question from a non-techie friend... she's a security auditor and needs a way to make sure the clients have set up their oracle security correctly.

She was wondering if there's a way to view all settings and tables without having write access to anything. Is there such thing as an administrator-user that can't change anything? Is there any provision to audit an oracle system?

So far all the clients say that's not possible...

-k

 

[rcurva]

If you receive a DBA grant, the answer to your question is definitely NO.

I do not get what do you mean by "all settings", if you mean database parameters then another NO answer for your question, bec. this will require DBA grant.

But if your "all settings" mean privileges/roles granted to the users, then you can set up such a user/role that can select on all tables but cannot do update/insert/delete.

 

[sem]

I suppose that the second answer will be YES. You may
grant select any table
to this user.
Of course, this user will not be DBA.