Cannot enable remote logins with ssh, it is against our security policy

[Arjen Visser]

Our Environment:
1) Our oracle software is installed with the unix userid "oracle", we DO NOT use oinstall.
2) Our instances run under the unix userid "oracle".
3) We can NOT enable remote logins for the unix userid "oracle", it's against our security policy.

Question:
Can I create a unix userid, "dbvisit", and install the software under it and enable ssh and rsync and have "dbvisit standby" software function correctly.

Answer:
Yes, the unix userid "dbvisit" can be created to install the software and run it and enable ssh, scp and rsync. There are 2 options to setup the "dbvisit" userid:

1. Have the dbvisit user be part of the Oracle "dba" Unix group. This way the Dbvisit software will be able to login to the database without a username password, OR
2. If your security policy does not allow the userid "dbvisit" to be part of the dba group, then edit the Dbvisit Database Configuration (DDC) file and set the SYS username and password under section: [25 Sys Logon Settings]. The DDC file is like the init.ora file but is used for Dbvisit configuration settings. The file looks like dbv_database_name.env.

[Arjen Visser]

A new userid can be created to install and configure Dbvisit instead of the oracle userid.
The user dbvisit has to be assigned to the same OS group as user oracle which in most cases is "dba".

However there maybe issues when Dbvisit tries to create a new standby database as the psfile/spfile needs to be re-created by Dbvisit. The permission of the pfile/spfile is typically:
-rw-r--r-- 1 oracle dba 12920 Jun 27 2005 initdw.ora
-rw-r--r-- 1 oracle dba 8385 Jun 27 2005 init.ora
-rw-rw---- 1 oracle dba 24 Aug 1 11:42 lkDBVISITP
-rwSr----- 1 oracle dba 2048 Jun 11 14:25 orapwdbvisitp
-rw-r--r-- 1 oracle dba 0 Feb 12 2008 show
-rw-r----- 1 oracle dba 4997120 Jun 16 13:23 snapcf_dbvisitp.f
-rw-r----- 1 oracle dba 3584 Aug 20 06:03 spfiledbvisitp.ora

Please note permissions on pfile/spfiles - only oracle can overwrite them.

In this case it is recommended to set the permission so that the dba group can update the spfile/pfile as per the following:
-rw-rw---- 1 oracle dba 3584 Aug 20 06:03 spfiledbvisitp.ora

In this case Dbvisit will be able to create the standby database if the Dbvisit userid is part of the dba group.