Oracle SYS/SYSTEM shared passwords

Question

Unfortunately we have a requirement not to have the sys/system passwords shared even among the DBA staff. Someone mentioned an Oracle article which details not having shared passwords. The problem is that security perceives this issue as a threat. I have argued until I am blue in the face that these two accounts are needed by the dba team. Does anyone have any information on this subject to pass along? Things that worked and even those that didnt? The real issue comes into play when you start looking at cron jobs on the oracle account which have most of the privileged passwords visible.
Thanks!

Answer 1

You could argue that with me - a DBA - until you are blue in the face and you would still loose. You DO NOT need the sys and system accounts to do your job as a DBA.
Here is what we do...
1. create a role, or set of roles something like DBA_SENIOR, DBA_SECURITY, DBA_USERADMIN, etc. Give them all of the privileges they need for their specific jobs.
2. create user accounts for each DBA - we use externally identified but they need not be.
3. grant each DBA his appropriate role.
4. create a password file.
5. grant sysdba to the DBAs - so that they can become SYS on those times when it is the only way to do what needs to be done.
6. give sys and system impossible passwords.
7. DO NOT grant DBA role to anyone.
Now you have met the requirement and your dba's can do their jobs. And if you create scripts, then it is easy to make this routine for whenever you create a database.