Drop SYS and SYSTEM accounts, good idea?

Viewed 43

I'm new to Oracle and I'm currently hardening a database. It's a good idea to drop SYS and SYSTEM users? normally default accounts are dropped because of security reasons, I can do that on Oracle, or I will break something?

2 Answers

From the documentation (emphasis added):

All databases include the administrative accounts SYS, SYSTEM, and DBSNMP. Administrative accounts are highly privileged accounts, and are needed only by individuals authorized to perform administrative tasks such as starting and stopping the database, managing database memory and storage, creating and managing database users, and so on. You log in to Oracle Enterprise Manager Database Express (EM Express) with SYS or SYSTEM. You assign the passwords for these accounts when you create the database with Oracle Database Configuration Assistant (DBCA). You must not delete or rename these accounts.

And:

All base (underlying) tables and views for the database data dictionary are stored in the SYS schema. These base tables and views are critical for the operation of Oracle Database.

So no, it is not a good idea, and it would destroy your database.


normally default accounts are dropped because of security reasons, I can do that on Oracle, or I will break something?

The first documentation link above also says (emphasis added again):

All databases also include internal accounts, which are automatically created so that individual Oracle Database features or components such as Oracle Application Express can have their own schemas. To protect these accounts from unauthorized access, they are initially locked and their passwords are expired. (A locked account is an account for which login is disabled.) You must not delete internal accounts, and you must not use them to log in to the database.

And it mentions sample schema accounts, which you can choose not to install in the first place, but which could be dropped if required.

The main thing is to secure all accounts, and you should limit any accounts you create to only have the minimum privileges necessary.

You can also read more about this in the database administrator's guide,

It is a very bad idea. I don't think the database will even work without them and doubt that the drop is allowed. Make sure the accounts are safe instead.

Related