Oracle X6-2-HA Deployment And User's Manual page 340

Managing OAKCLI Privileges and Security with SUDO
Oracle Appliance Manager command-line utility requires root system privileges for
most administration actions. You may want to use SUDO as part of your system
auditing and security policy.
For most tasks, Oracle recommends that you log in as root to use the Oracle
Appliance Manager command-line interface on Oracle Database Appliance. If you are
not logged in as root, then you cannot carry out most actions on the appliance. For
example, if you are not logged in as root, then you can view storage information, but
you cannot modify the storage.
Allowing Root User Access Using SUDO
In environments where system administration is handled by a different group than
database administration, or where security is a significant concern, you may want to
limit access to the root user account and password. SUDO enables system
administrators to grant certain users (or groups of users) the ability to run commands
as root, while logging all commands and arguments as part of your security and
compliance protocol.
A SUDO security policy is configured by using the file /etc/sudoers. Within the
sudoers file, you can configure groups of users and sets of commands to simplify and
audit server administration with SUDO commands.
Caution:
Configuring SUDO to allow a user to perform any operation is equivalent to
giving that user root privileges. Consider carefully if this is appropriate for
your security needs.
SUDO Example 1: Allow a User to Perform Any OAKCLI Operation
This example shows how to configure SUDO to enable a user to perform any OAKCLI
operation. You do this by adding lines to the commands section in the /etc/sudoers
file:
## The commands section may have other options added to it.
##
Cmnd_Alias OAKCLI_CMDS=/opt/oracle/oak/bin/oakcli *
jdoe ALL = OAKCLI_CMDS
In this example, the user name is jdoe. The file parameter setting ALL= OAKCLI_CMDS
grants the user jdoe permission to run all oakcli commands that are defined by the
command alias OAKCLI_CMDS. After configuration, you can copy one sudoers file to
multiple hosts. You can also create different rules on each host.
Managing OAKCLI Privileges and Security with SUDO
Chapter 14
14-5