【Oracle】DCL语言

在这里插入图片描述

个人主页：Guiat
归属专栏：Oracle

在这里插入图片描述

文章目录

1. DCL概述
- 1.1 什么是DCL？
- 1.2 DCL的核心功能
2. 用户管理
- 2.1 创建用户
- 2.2 修改用户
- 2.3 删除用户
- 2.4 用户信息查询
3. 权限管理
- 3.1 系统权限
- - 3.1.1 授予系统权限
  - 3.1.2 撤销系统权限
- 3.2 对象权限
- - 3.2.1 实际应用示例
- 3.3 权限查询
4. 角色管理
- 4.1 角色的概念
- 4.2 创建和管理角色
- 4.3 角色分配和撤销
- 4.4 实际角色设计案例
- - 4.4.1 企业人事管理系统角色设计
  - 4.4.2 电商系统角色设计
5. 高级安全特性
- 5.1 用户配置文件（Profile）
- 5.2 审计功能
- 5.3 虚拟私有数据库（VPD）
6. 实际应用案例
- 6.1 多租户SaaS应用权限设计
- 6.2 金融系统权限控制
- 6.3 医疗系统HIPAA合规权限设计
7. 权限管理最佳实践
- 7.1 权限设计原则
- 7.2 权限清理和维护脚本
- 7.3 安全配置检查清单

正文

DCL（Data Control Language）是Oracle数据库中负责数据安全和权限管理的语言，就像数据库的"门卫"和"管家"，决定谁能进来、谁能做什么。如果说DDL是建房子的，DML是装修房子的，那DCL就是管理房子钥匙的！

1. DCL概述

1.1 什么是DCL？

DCL就像是数据库的"安保系统"，它负责控制用户对数据库对象的访问权限。在Oracle这个数据库王国里，DCL确保每个用户都只能访问被授权的数据和功能，就像皇宫里的等级制度一样严格。

1.2 DCL的核心功能

Oracle DCL的功能架构就像一个完整的权限管理体系：

2. 用户管理

2.1 创建用户

在Oracle中创建用户就像注册一个新账户，需要指定各种属性：

-- 基本用户创建
CREATE USER hr_user
IDENTIFIED BY password123
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
QUOTA 100M ON users;

-- 创建带详细配置的用户
CREATE USER sales_manager
IDENTIFIED BY SecurePass2024
DEFAULT TABLESPACE sales_data
TEMPORARY TABLESPACE temp
QUOTA 500M ON sales_data
QUOTA 50M ON indexes
PASSWORD EXPIRE
ACCOUNT UNLOCK;

-- 使用外部认证创建用户
CREATE USER external_user
IDENTIFIED EXTERNALLY
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp;

-- 创建应用程序用户
CREATE USER app_user
IDENTIFIED BY app_password
DEFAULT TABLESPACE app_data
TEMPORARY TABLESPACE temp
QUOTA UNLIMITED ON app_data
PROFILE app_profile;

2.2 修改用户

用户创建后，就像人会成长变化一样，用户属性也需要调整：

-- 修改用户密码
ALTER USER hr_user IDENTIFIED BY new_password123;

-- 修改用户的表空间配额
ALTER USER sales_manager QUOTA 1G ON sales_data;

-- 锁定用户账户
ALTER USER problem_user ACCOUNT LOCK;

-- 解锁用户账户
ALTER USER problem_user ACCOUNT UNLOCK;

-- 强制密码过期
ALTER USER hr_user PASSWORD EXPIRE;

-- 修改默认表空间
ALTER USER sales_manager DEFAULT TABLESPACE new_tablespace;

-- 为用户分配配置文件
ALTER USER hr_user PROFILE strict_profile;

-- 综合修改用户属性
ALTER USER app_user
    IDENTIFIED BY new_app_password
    DEFAULT TABLESPACE new_app_data
    QUOTA 2G ON new_app_data
    ACCOUNT UNLOCK
    PASSWORD EXPIRE;

2.3 删除用户

删除用户要谨慎，就像注销账户一样不可逆：

-- 删除用户（用户不能拥有任何对象）
DROP USER simple_user;

-- 级联删除用户及其所有对象
DROP USER old_user CASCADE;

-- 删除前检查用户拥有的对象
SELECT object_name, object_type 
FROM dba_objects 
WHERE owner = 'OLD_USER';

2.4 用户信息查询

了解用户状态就像查看员工档案：

-- 查看所有用户基本信息
SELECT username, account_status, created, default_tablespace
FROM dba_users
ORDER BY created DESC;

-- 查看用户的表空间配额
SELECT username, tablespace_name, bytes, max_bytes
FROM dba_ts_quotas
WHERE username = 'HR_USER';

-- 查看用户会话信息
SELECT username, sid, serial#, status, program
FROM v$session
WHERE username IS NOT NULL;

-- 查看用户的配置文件
SELECT username, profile, account_status, lock_date
FROM dba_users
WHERE username IN ('HR_USER', 'SALES_MANAGER');

3. 权限管理

3.1 系统权限

系统权限就像是数据库的"通行证"，决定用户能在数据库中做什么：

3.1.1 授予系统权限

-- 授予基本连接权限
GRANT CREATE SESSION TO hr_user;

-- 授予创建表的权限
GRANT CREATE TABLE TO hr_user;

-- 授予多个权限
GRANT CREATE TABLE, CREATE VIEW, CREATE PROCEDURE TO developer_user;

-- 授予带管理员选项的权限（可以转授给其他用户）
GRANT CREATE USER TO hr_manager WITH ADMIN OPTION;

-- 授予查询任意表的权限
GRANT SELECT ANY TABLE TO audit_user;

-- 批量授予常用开发权限
GRANT 
    CREATE SESSION,
    CREATE TABLE,
    CREATE VIEW,
    CREATE PROCEDURE,
    CREATE SEQUENCE,
    CREATE SYNONYM
TO developer_role;

3.1.2 撤销系统权限

-- 撤销特定权限
REVOKE CREATE TABLE FROM hr_user;

-- 撤销多个权限
REVOKE CREATE VIEW, CREATE PROCEDURE FROM developer_user;

-- 撤销管理员权限
REVOKE CREATE USER FROM hr_manager;

3.2 对象权限

对象权限更加精细，就像给每个房间分配不同的钥匙：

-- 授予表的查询权限
GRANT SELECT ON employees TO hr_user;

-- 授予表的增删改查权限
GRANT SELECT, INSERT, UPDATE, DELETE ON departments TO hr_manager;

-- 授予表的特定列更新权限
GRANT UPDATE (salary, commission_pct) ON employees TO payroll_user;

-- 授予执行存储过程的权限
GRANT EXECUTE ON calculate_bonus TO hr_manager;

-- 授予带授权选项的权限（可以转授给其他用户）
GRANT SELECT ON employees TO hr_manager WITH GRANT OPTION;

-- 授予视图权限
GRANT SELECT ON employee_summary_view TO report_user;

-- 授予序列权限
GRANT SELECT ON employee_seq TO hr_user;

3.2.1 实际应用示例

-- 为不同角色分配合适的权限
-- 1. 人事部门查询员工信息
GRANT SELECT ON employees TO hr_dept;
GRANT SELECT ON departments TO hr_dept;
GRANT SELECT ON jobs TO hr_dept;

-- 2. 财务部门访问薪资相关数据
GRANT SELECT ON employees TO finance_dept;
GRANT UPDATE (salary) ON employees TO finance_manager;
GRANT SELECT ON payroll_history TO finance_dept;

-- 3. 开发团队访问测试数据
GRANT SELECT, INSERT, UPDATE, DELETE ON test_employees TO dev_team;
GRANT CREATE TABLE TO dev_lead;
GRANT DROP ANY TABLE TO dev_lead;

-- 4. 报表用户只读权限
GRANT SELECT ON employees TO report_user;
GRANT SELECT ON departments TO report_user;
GRANT SELECT ON sales_data TO report_user;

3.3 权限查询

了解权限分配情况就像查看通讯录：

-- 查看用户拥有的系统权限
SELECT grantee, privilege, admin_option
FROM dba_sys_privs
WHERE grantee = 'HR_USER'
ORDER BY privilege;

-- 查看用户拥有的对象权限
SELECT grantee, owner, table_name, privilege, grantable
FROM dba_tab_privs
WHERE grantee = 'HR_USER'
ORDER BY owner, table_name;

-- 查看当前用户的权限
SELECT * FROM user_sys_privs;
SELECT * FROM user_tab_privs;

-- 查看角色包含的权限
SELECT role, privilege
FROM dba_role_privs
WHERE grantee = 'HR_ROLE';

-- 查看谁有特定表的权限
SELECT grantee, privilege, grantable
FROM dba_tab_privs
WHERE owner = 'HR' AND table_name = 'EMPLOYEES';

4. 角色管理

4.1 角色的概念

角色就像是职位头衔，把相关的权限打包在一起，方便管理：

4.2 创建和管理角色

-- 创建基本角色
CREATE ROLE hr_role;

-- 创建带密码的角色
CREATE ROLE secure_role IDENTIFIED BY role_password;

-- 创建不能被启用的角色（需要密码）
CREATE ROLE admin_role NOT IDENTIFIED;

-- 为角色分配权限
GRANT CREATE SESSION TO hr_role;
GRANT SELECT ON employees TO hr_role;
GRANT SELECT ON departments TO hr_role;

-- 创建复杂的业务角色
CREATE ROLE employee_manager;
GRANT CREATE SESSION TO employee_manager;
GRANT SELECT, INSERT, UPDATE ON employees TO employee_manager;
GRANT SELECT ON departments TO employee_manager;
GRANT EXECUTE ON hr_procedures TO employee_manager;

-- 创建角色层次
CREATE ROLE junior_developer;
CREATE ROLE senior_developer;
CREATE ROLE lead_developer;

-- 基础开发权限
GRANT CREATE SESSION TO junior_developer;
GRANT CREATE TABLE TO junior_developer;
GRANT CREATE VIEW TO junior_developer;

-- 高级开发权限（包含基础权限）
GRANT junior_developer TO senior_developer;
GRANT CREATE PROCEDURE TO senior_developer;
GRANT CREATE PACKAGE TO senior_developer;

-- 领导权限（包含高级权限）
GRANT senior_developer TO lead_developer;
GRANT DROP ANY TABLE TO lead_developer;
GRANT CREATE USER TO lead_developer;

4.3 角色分配和撤销

-- 将角色分配给用户
GRANT hr_role TO hr_user;
GRANT employee_manager TO hr_manager;

-- 将角色分配给其他角色
GRANT junior_developer TO development_team;

-- 分配默认角色
ALTER USER hr_user DEFAULT ROLE hr_role;

-- 分配所有角色作为默认
ALTER USER developer DEFAULT ROLE ALL;

-- 撤销角色
REVOKE hr_role FROM hr_user;
REVOKE employee_manager FROM hr_manager;

-- 删除角色
DROP ROLE old_role;

4.4 实际角色设计案例

4.4.1 企业人事管理系统角色设计

-- 1. 创建基础角色
CREATE ROLE app_user;
GRANT CREATE SESSION TO app_user;

-- 2. 创建部门角色
CREATE ROLE hr_department;
CREATE ROLE finance_department;
CREATE ROLE it_department;

-- 继承基础权限
GRANT app_user TO hr_department;
GRANT app_user TO finance_department;
GRANT app_user TO it_department;

-- 3. 人事部门权限
GRANT SELECT, INSERT, UPDATE ON employees TO hr_department;
GRANT SELECT, INSERT, UPDATE ON departments TO hr_department;
GRANT SELECT ON salary_grades TO hr_department;
GRANT EXECUTE ON hr_pkg TO hr_department;

-- 4. 财务部门权限
GRANT SELECT ON employees TO finance_department;
GRANT UPDATE (salary, bonus) ON employees TO finance_department;
GRANT SELECT, INSERT, UPDATE ON payroll TO finance_department;
GRANT EXECUTE ON finance_pkg TO finance_department;

-- 5. IT部门权限
GRANT SELECT ON all_users TO it_department;
GRANT SELECT ON dba_objects TO it_department;
GRANT CREATE TABLE TO it_department;
GRANT CREATE PROCEDURE TO it_department;

-- 6. 创建管理角色
CREATE ROLE hr_manager;
CREATE ROLE finance_manager;
CREATE ROLE it_manager;

GRANT hr_department TO hr_manager;
GRANT finance_department TO finance_manager;
GRANT it_department TO it_manager;

-- 管理员额外权限
GRANT DELETE ON employees TO hr_manager;
GRANT CREATE USER TO hr_manager;
GRANT ALTER USER TO finance_manager;
GRANT DROP ANY TABLE TO it_manager;

4.4.2 电商系统角色设计

-- 电商系统角色架构
CREATE ROLE customer_service;
CREATE ROLE order_manager;
CREATE ROLE inventory_manager;
CREATE ROLE sales_analyst;
CREATE ROLE system_admin;

-- 客服角色权限
GRANT CREATE SESSION TO customer_service;
GRANT SELECT ON customers TO customer_service;
GRANT SELECT ON orders TO customer_service;
GRANT UPDATE (status) ON orders TO customer_service;
GRANT SELECT ON products TO customer_service;

-- 订单管理角色权限
GRANT customer_service TO order_manager;
GRANT INSERT, UPDATE, DELETE ON orders TO order_manager;
GRANT INSERT, UPDATE ON order_items TO order_manager;
GRANT EXECUTE ON order_processing_pkg TO order_manager;

-- 库存管理角色权限
GRANT CREATE SESSION TO inventory_manager;
GRANT SELECT, INSERT, UPDATE ON products TO inventory_manager;
GRANT SELECT, INSERT, UPDATE ON inventory TO inventory_manager;
GRANT EXECUTE ON inventory_pkg TO inventory_manager;

-- 销售分析角色权限
GRANT CREATE SESSION TO sales_analyst;
GRANT SELECT ON orders TO sales_analyst;
GRANT SELECT ON order_items TO sales_analyst;
GRANT SELECT ON products TO sales_analyst;
GRANT SELECT ON customers TO sales_analyst;
GRANT CREATE TABLE TO sales_analyst; -- 创建临时分析表

5. 高级安全特性

5.1 用户配置文件（Profile）

Profile就像是用户的"行为规范"，限制用户的资源使用：

-- 创建严格的密码策略配置文件
CREATE PROFILE strict_security_profile LIMIT
    SESSIONS_PER_USER 2                    -- 最多2个并发会话
    CPU_PER_SESSION 3000                   -- 每会话CPU限制（百分之一秒）
    CPU_PER_CALL 1000                      -- 每次调用CPU限制
    CONNECT_TIME 120                       -- 连接时间限制（分钟）
    IDLE_TIME 15                           -- 空闲时间限制（分钟）
    LOGICAL_READS_PER_SESSION 10000        -- 每会话逻辑读限制
    LOGICAL_READS_PER_CALL 1000            -- 每次调用逻辑读限制
    PRIVATE_SGA 100K                       -- 私有SGA限制
    COMPOSITE_LIMIT 5000000;               -- 综合资源限制

-- 创建密码策略配置文件
CREATE PROFILE password_policy LIMIT
    FAILED_LOGIN_ATTEMPTS 3                -- 登录失败次数限制
    PASSWORD_LIFE_TIME 90                  -- 密码有效期（天）
    PASSWORD_REUSE_TIME 365                -- 密码重用时间间隔
    PASSWORD_REUSE_MAX 12                  -- 密码重用次数限制
    PASSWORD_LOCK_TIME 1/24                -- 账户锁定时间（1小时）
    PASSWORD_GRACE_TIME 7;                 -- 密码到期宽限期

-- 应用配置文件到用户
ALTER USER hr_user PROFILE strict_security_profile;
ALTER USER sales_user PROFILE password_policy;

5.2 审计功能

审计就像是数据库的"监控摄像头"，记录所有重要操作：

-- 启用数据库审计
ALTER SYSTEM SET audit_trail=DB SCOPE=SPFILE;

-- 审计特定操作
AUDIT SELECT TABLE, INSERT TABLE, UPDATE TABLE, DELETE TABLE;

-- 审计特定用户的操作
AUDIT ALL BY hr_user;

-- 审计特定对象的访问
AUDIT SELECT ON employees BY ACCESS;

-- 审计系统权限的使用
AUDIT CREATE TABLE, DROP TABLE;

-- 审计登录和登出
AUDIT SESSION;

-- 查看审计记录
SELECT username, action_name, object_name, timestamp
FROM dba_audit_trail
WHERE username = 'HR_USER'
ORDER BY timestamp DESC;

-- 细粒度审计（FGA）
BEGIN
    DBMS_FGA.ADD_POLICY(
        object_schema   => 'HR',
        object_name     => 'EMPLOYEES',
        policy_name     => 'salary_access_audit',
        audit_condition => 'SALARY > 10000',
        audit_column    => 'SALARY',
        handler_schema  => 'SECURITY',
        handler_module  => 'AUDIT_HANDLER',
        enable          => TRUE
    );
END;
/

5.3 虚拟私有数据库（VPD）

VPD就像是数据的"隐形眼镜"，让用户只能看到被授权的数据：

-- 创建安全策略函数
CREATE OR REPLACE FUNCTION dept_security_policy(
    schema_var IN VARCHAR2,
    table_var IN VARCHAR2
) RETURN VARCHAR2 AS
    predicate VARCHAR2(400);
BEGIN
    -- 根据当前用户限制可见的部门数据
    IF USER = 'HR_USER' THEN
        predicate := 'DEPARTMENT_ID IN (10, 20)';
    ELSIF USER = 'SALES_USER' THEN
        predicate := 'DEPARTMENT_ID = 30';
    ELSE
        predicate := '1=2'; -- 默认不允许访问
    END IF;
    
    RETURN predicate;
END;
/

-- 应用安全策略
BEGIN
    DBMS_RLS.ADD_POLICY(
        object_schema   => 'HR',
        object_name     => 'EMPLOYEES',
        policy_name     => 'dept_security_policy',
        function_schema => 'SECURITY',
        policy_function => 'dept_security_policy',
        statement_types => 'SELECT,INSERT,UPDATE,DELETE'
    );
END;
/

6. 实际应用案例

6.1 多租户SaaS应用权限设计

-- SaaS应用的多租户权限架构
-- 1. 创建租户隔离策略
CREATE OR REPLACE FUNCTION tenant_isolation_policy(
    schema_var IN VARCHAR2,
    table_var IN VARCHAR2
) RETURN VARCHAR2 AS
    tenant_id NUMBER;
    predicate VARCHAR2(400);
BEGIN
    -- 从应用上下文获取租户ID
    tenant_id := SYS_CONTEXT('TENANT_CTX', 'TENANT_ID');
    
    IF tenant_id IS NOT NULL THEN
        predicate := 'tenant_id = ' || tenant_id;
    ELSE
        predicate := '1=2'; -- 没有租户ID则无法访问数据
    END IF;
    
    RETURN predicate;
END;
/

-- 2. 创建应用上下文
CREATE OR REPLACE CONTEXT tenant_ctx USING tenant_pkg;

-- 3. 创建设置租户上下文的包
CREATE OR REPLACE PACKAGE tenant_pkg AS
    PROCEDURE set_tenant_id(p_tenant_id NUMBER);
END;
/

CREATE OR REPLACE PACKAGE BODY tenant_pkg AS
    PROCEDURE set_tenant_id(p_tenant_id NUMBER) AS
    BEGIN
        DBMS_SESSION.SET_CONTEXT('TENANT_CTX', 'TENANT_ID', p_tenant_id);
    END;
END;
/

-- 4. 应用到所有业务表
BEGIN
    FOR rec IN (SELECT table_name FROM user_tables WHERE table_name LIKE '%_DATA') LOOP
        DBMS_RLS.ADD_POLICY(
            object_schema   => USER,
            object_name     => rec.table_name,
            policy_name     => 'tenant_isolation',
            function_schema => USER,
            policy_function => 'tenant_isolation_policy',
            statement_types => 'SELECT,INSERT,UPDATE,DELETE'
        );
    END LOOP;
END;
/

6.2 金融系统权限控制

-- 金融系统的分级权限控制
-- 1. 创建职级角色
CREATE ROLE teller;          -- 柜员
CREATE ROLE supervisor;      -- 主管
CREATE ROLE manager;         -- 经理
CREATE ROLE auditor;         -- 审计员

-- 2. 基础权限分配
GRANT CREATE SESSION TO teller;
GRANT teller TO supervisor;
GRANT supervisor TO manager;

-- 3. 柜员权限（基础操作）
GRANT SELECT ON customers TO teller;
GRANT SELECT ON accounts TO teller;
GRANT INSERT ON transactions TO teller;
GRANT UPDATE (balance) ON accounts TO teller;

-- 4. 主管权限（包含柜员权限+审批权限）
GRANT UPDATE (status) ON transactions TO supervisor;
GRANT SELECT ON transaction_logs TO supervisor;

-- 5. 经理权限（包含主管权限+管理权限）
GRANT INSERT, UPDATE, DELETE ON customers TO manager;
GRANT CREATE TABLE TO manager;
GRANT EXECUTE ON admin_procedures TO manager;

-- 6. 审计员权限（只读+特殊审计权限）
GRANT SELECT ON ALL_TABLES TO auditor;
GRANT SELECT ON audit_trail TO auditor;
GRANT EXECUTE ON audit_reports TO auditor;

-- 7. 创建金额限制策略
CREATE OR REPLACE FUNCTION transaction_limit_policy(
    schema_var IN VARCHAR2,
    table_var IN VARCHAR2
) RETURN VARCHAR2 AS
    user_role VARCHAR2(30);
    predicate VARCHAR2(400);
BEGIN
    -- 获取用户角色
    SELECT granted_role INTO user_role
    FROM user_role_privs 
    WHERE granted_role IN ('TELLER', 'SUPERVISOR', 'MANAGER')
    AND rownum = 1;
    
    CASE user_role
        WHEN 'TELLER' THEN
            predicate := 'amount <= 10000';
        WHEN 'SUPERVISOR' THEN
            predicate := 'amount <= 50000';
        WHEN 'MANAGER' THEN
            predicate := 'amount <= 1000000';
        ELSE
            predicate := '1=2';
    END CASE;
    
    RETURN predicate;
EXCEPTION
    WHEN NO_DATA_FOUND THEN
        RETURN '1=2';
END;
/

6.3 医疗系统HIPAA合规权限设计

-- 医疗系统的HIPAA合规权限设计
-- 1. 创建医疗角色层次
CREATE ROLE medical_staff;
CREATE ROLE nurse;
CREATE ROLE doctor;
CREATE ROLE admin_staff;
CREATE ROLE privacy_officer;

-- 2. 基础医疗人员权限
GRANT CREATE SESSION TO medical_staff;
GRANT SELECT ON patients TO medical_staff;
GRANT SELECT ON appointments TO medical_staff;

-- 3. 护士权限
GRANT medical_staff TO nurse;
GRANT UPDATE (vital_signs, notes) ON patient_records TO nurse;
GRANT INSERT ON nursing_notes TO nurse;

-- 4. 医生权限
GRANT nurse TO doctor;
GRANT INSERT, UPDATE ON patient_records TO doctor;
GRANT INSERT ON prescriptions TO doctor;
GRANT SELECT ON medical_history TO doctor;

-- 5. 创建患者访问控制策略
CREATE OR REPLACE FUNCTION patient_access_policy(
    schema_var IN VARCHAR2,
    table_var IN VARCHAR2
) RETURN VARCHAR2 AS
    staff_id NUMBER;
    predicate VARCHAR2(2000);
BEGIN
    -- 获取当前医护人员ID
    SELECT employee_id INTO staff_id
    FROM medical_staff_mapping
    WHERE username = USER;
    
    -- 只能访问分配给自己的患者
    predicate := 'patient_id IN (
        SELECT patient_id 
        FROM patient_assignments 
        WHERE staff_id = ' || staff_id || ' 
        AND assignment_date <= SYSDATE 
        AND (end_date IS NULL OR end_date >= SYSDATE)
    )';
    
    RETURN predicate;
EXCEPTION
    WHEN NO_DATA_FOUND THEN
        RETURN '1=2';
END;
/

-- 6. 创建审计日志记录
CREATE OR REPLACE TRIGGER patient_access_audit
    AFTER SELECT ON patient_records
    FOR EACH STATEMENT
BEGIN
    INSERT INTO hipaa_audit_log (
        username,
        access_time,
        table_accessed,
        action_type,
        ip_address
    ) VALUES (
        USER,
        SYSTIMESTAMP,
        'PATIENT_RECORDS',
        'SELECT',
        SYS_CONTEXT('USERENV', 'IP_ADDRESS')
    );
END;
/

7. 权限管理最佳实践

7.1 权限设计原则

7.2 权限清理和维护脚本

-- 权限维护和清理脚本

-- 1. 查找长期未使用的用户
SELECT username, created, last_login
FROM (
    SELECT u.username, u.created,
           MAX(s.logon_time) as last_login
    FROM dba_users u
    LEFT JOIN dba_audit_session s ON u.username = s.username
    WHERE u.account_status = 'OPEN'
    GROUP BY u.username, u.created
)
WHERE last_login < SYSDATE - 90
   OR last_login IS NULL;

-- 2. 查找拥有过多权限的用户
SELECT grantee, COUNT(*) as privilege_count
FROM (
    SELECT grantee FROM dba_sys_privs
    UNION ALL
    SELECT grantee FROM dba_tab_privs
    UNION ALL
    SELECT grantee FROM dba_role_privs
)
GROUP BY grantee
HAVING COUNT(*) > 50
ORDER BY privilege_count DESC;

-- 3. 查找直接授予用户的权限（应该通过角色授予）
SELECT grantee, privilege, 'SYSTEM' as privilege_type
FROM dba_sys_privs
WHERE grantee NOT IN (SELECT role FROM dba_roles)
UNION ALL
SELECT grantee, privilege, 'OBJECT' as privilege_type
FROM dba_tab_privs
WHERE grantee NOT IN (SELECT role FROM dba_roles);

-- 4. 权限回收脚本生成
SELECT 'REVOKE ' || privilege || ' FROM ' || grantee || ';' as revoke_sql
FROM dba_sys_privs
WHERE grantee = 'OLD_USER';

-- 5. 创建权限备份
CREATE TABLE user_privileges_backup AS
SELECT 'GRANT ' || privilege || ' TO ' || grantee || 
       CASE WHEN admin_option = 'YES' THEN ' WITH ADMIN OPTION' END ||
       ';' as grant_sql,
       grantee, privilege, SYSDATE as backup_date
FROM dba_sys_privs
WHERE grantee = 'BACKUP_USER';

7.3 安全配置检查清单

-- 安全配置检查脚本

-- 1. 检查默认密码用户
SELECT username, account_status
FROM dba_users
WHERE username IN ('SCOTT', 'HR', 'OE', 'SH', 'PM')
  AND account_status != 'LOCKED';

-- 2. 检查具有DBA权限的用户
SELECT grantee
FROM dba_role_privs
WHERE granted_role = 'DBA'
  AND grantee != 'SYS';

-- 3. 检查密码策略配置
SELECT profile, resource_name, limit
FROM dba_profiles
WHERE resource_type = 'PASSWORD'
  AND profile = 'DEFAULT'
ORDER BY resource_name;

-- 4. 检查审计配置状态
SELECT name, value
FROM v$parameter
WHERE name LIKE '%audit%';

-- 5. 检查用户会话限制
SELECT username, sessions_per_user, cpu_per_session
FROM dba_users u, dba_profiles p
WHERE u.profile = p.profile
  AND p.resource_name IN ('SESSIONS_PER_USER', 'CPU_PER_SESSION')
  AND p.limit != 'UNLIMITED';