Oracle Security

Default User Accounts

In the various versions of Oracle, when you create a database, some user accounts are automatically created by default. In every version, sys and system are created. In the later versions of Oracle7 (beginning in version 7.1.6 or version 7.2), the user dbsnmp is created automatically to support the Oracle Enterprise Manager intelligent agent. As of Oracle8, scott (a standard account you can use for demonstrations, testing, and training users in a known environment) is automatically created and populated, as are other users based on the cartridges you have selected for installation. Let’s take a closer look at the default user accounts that are created and their potential impacts on database security.

Default Users and Their Roles

When a Personal Oracle8 database is created using version 8.0.3, several users are created by default:

• sys

• system

• dbsnmp

• scott

• demo

• po8 (for Personal Oracle8)

The sys user is always assigned the password change_on_install. sys is the heart of the Oracle system. You must work very carefully when logged on as sys, since you have the ability to do severe damage to the database from this account.

The system user always receives the password manager. Because the sys and system passwords are pre-set, the DBA always knows the initial passwords necessary to log on as either system or sys to begin interacting with the database. system is the account from which you initially create your tablespaces, rollback segments, and users.

Note ...