Root password

[Clara Rowe]

Dear Experts,
This one should be easy for you, I just want your opinions. The DBA's in our shop say they need to have the root password. What are your thoughts?

Thanx.
Clara

[Craig Rants · Accepted solution]

Install sudo and give them access to the commands they need, that will create a definative list of what they need and not make you look like that bad guy.

[Uday_S_Ankolekar]

Hi,

My answer is NO..

The DBA related tasks can sure be handled by by them with the proper permissions and groups and for the System admin tasks you are there to help them.
Ask them why they want the root password..? Inface you can give them restricted permission to do some of admin jobs. by restricted sam. (sam -r)
or you can use sudo utility and have control on their "system administartion"


-USA..

[Sachin Patel]

Hi Clara,
If I were you I say no. What is there requirement? Why they need root accesss? You can setup sudo or super for it.
If it is small compan. and only few system I will do it. It it is big comp. and lots of different department handle by different persons I will not.

Sachin

[Santosh Nair_1]

I would say absolutely not. I understand that Oracle needs some scripts run as root when you first install it, but that's a one time thing. The DBAs should be able to do their jobs without root permissions since all the database files are usually owned by the DBA.

Also, it would help if you mentioned which database product they administer.

Hope this helps.

-Santosh

[James Beamish-White]

This is an exerpt from an oracle security document by Mike Henderson:

The DBA position, and that of the root user, are trusted positions. It is almost impossible to subdivide the job specifications into roles where no one person can do 'too much' and still perform the role effectively in a commercial environment.

I'm not a DBA, I'm a sysadmin, so I don't know what their role entails that can't be got around by having their sysadmin do file system resizing and kernel tuning, but hey, I'm not the DB expert, Mike Henderson is supposed to be...

Cheers,
James

[Patrick Wallek]

I must echo everyone else's statements.

Do NOT give the DBA's unlimited root access. If they screw something up inadvertantly, will they tell you EXACTLY what they did? Probably not. And guess who gets to figure out what happened? :)

Install sudo. You can set sudo up so that they can run only what they absolutely have to, and they don't have the root passwd.

The root passwd should be given to the abolute minimum number of people possible.

[linuxfan]

Hi Clara,

The simple answer is NO. Most of the times they only need root access to run the root.sh script while installling oracle, you can set up sudo and give them access to run that script.

The best solution is sudo, rather than giving out root access

You can find out more about sudo from

http://www.courtesan.com/sudo/

-Regards
Ramesh

[James R. Ferguson]

Hi:

I don't provide my DBA's with a root password, either. I've got scripts they can use for things like pfs_mounts and beyond that, I'm happy to assist when they need root access.

Regards!

...JRF...

[Rainer von Bongartz]

root is root and DBA is DBA. That's how it't supposed to be and there should be no need to give away the root password just to admin a database ( At least not for ORACLE,INFORMIX or DB2).

[A. Clay Stephenson]

Hi Clara:

Tell them you want the sys and system Oracle passwords and see what they say. At virtually every site at which I've worked this request comes up and I always say no. The duties are very different and the last thing that you want is for one of those guys to find a nice unused disk (i.e. no filesystem is mounted) and grab your swapspace. There are actually very few times when uid 0 is needed and in the worst case I would create a very small set of setuid wrappers on install sudo to do the same thing on a very limited number of commands. Pfs_mount is tricky enough without having a bunch of DBA's really messing it up.


Clay

[John Bolene]

I agree, not a chance, don't do it.
Our DBA's have never asked and have never needed it.

Ask what they need it for.

[Wodisch]

Hello Clara,

just another voice to say "no"...

DBAs do NOT need it, all they need are proper permissions of the mount-points, file-systems, raw-devices and config-files they need/use, but NOTHING about UN*X-administration.
You migh try telling them, that they have to pass the HP-UX administration certification and the BrainBench UN*X admin certification (and something the like else), before they can get super-user-access on *your* machines.
If they sign you a general "it is my fault" statement with a proof of their insurance covering the costs for a multi-hour-downtime of *your* systems, you can start considering it :-)

Just my $0.02,
Wodisch

[Darrell Allen]

DBAs the world over want root authority. So do a lot of developers, operators, hackers...

Don't give it! SAs are charged with the security of the systems and are responsible for such. No one else needs root (including pointy-haired managers who don't have a clue about UNIX but do like power). There are tools to give neccessary priviledges to those who really do need it.

If someone outside the sysadmin group has root, they can have the whole box as far as I'm concerned because I can no longer be responsible for the integrity of the box.

Darrell

[Alan Riggs]

*ditto*

Unix is a multi user OS and every commercial database vendor for the last quarter century has segregated the roles of systems administrator and database administrator into separate users.

Coincidence? I think not.

Root privelege should be guarded closely and zealously. Trust me, the first time you lose a production system to a well-meaning but less-than-fully-competent coworker you will learn that lesson for all time.

[Clara Rowe]

Thank you one and all for confirming what I knew to be true. I just wanted to have you experts back me up on my position. I intend to say NO to the Oracle DBA's but your comments will help management see that this is the norm.

Thanx again you are the best!

Clara

[David Lodge]

Just to put a point forward from the opposition.

At my old place of work DBAs and SAs where strongly segregated, this generally worked fine with a few areas of contention (eg not enough disc space for expansion, problems editing various files.)

At my current place of work the DBA and SA roles have been mangled together and no matter what people will think it does work.

There are arguements for both sides of this:
Against: DBAs don't know what they are doing (but neither do a lot of SAs)
For: Greater efficiency (but greater risk of damage)

I could continue for pages in the above vein... Essentially look at *your* DBAs - would *you* trust them with your passwords? Would they trust you with their's?

If not look at sudo - it will allow them to do important DBA things without giving them full root access - but be careful; eg don't let them run 'vi' under sudo etc...

dave (the SA, but part time DBA!