I have a custom oracle user(let's say monitor_user) which has lots of procedures and jobs that sends e-mail of query results. But for security reasons i want to disable its login to database from an outside client. How do i achieve that? I think removing "CREATE SESSION" won't help me.
2
-
What version of Oracle are you using?– pmdbaCommented Sep 5 at 11:22
-
I'm using Oracle 19c.– postgresnewbieCommented Sep 6 at 5:42
Add a comment
|
1 Answer
Without the CREATE SESSION privilege, the account cannot log into the database.
That sounds exactly like what you need.
There is an argument that you could just LOCK the account.
It will continue to exist and do useful things, but can't be logged into.
Personally, I have my doubts about that, simply because accounts can get locked for [lots of] other reasons and, if someone were to ask the [over-worked, spread-too-thin, multi-tasking] DBA "Can you unlock account XYZ?" they might well just do it.
Not having CREATE SESSION seems [to me] to be a more deliberate action to prevent anyone logging in with this account. Not having CREATE SESSION would be unusual and would [hopefully] raise Red Flags if someone were to ask for it to be "added" to an account.
-
1Thanks but doesn't CREATE SESSION's absence causes scheduled jobs not run? Commented Sep 5 at 8:28
-
I suspect locking the account would have the same effect. Changing the password makes the system vulnerable, even if someone /fails/ to hack the password. Personally, I [try to] avoid having Processes running as the same account that "owns" the actual Data. If that, exposed, account gets hacked then only the data available to that account (specific grants, Least Privilege and all that) is compromised, not /everything/ that the account owns. Also, the owner can drop tables; the Job account should not be able to.– Phill W.Commented Sep 6 at 7:29
-