Sys as sysdba/sysoper

Question

Hi there
Can any body explain me, why SYS user should always connect to the database as SYSDBA/SYSOPER only?
Why he cannot login without as a SYSDBA/SYSOPER.
TIA
Aqueel.

Answer 1

Though you should understand the implications of making this change. Here's the excerpt from the Oracle docs.
"O7_DICTIONARY_ACCESSIBILITY is intended for use when you migrate from Oracle7 to Oracle9i. It controls restrictions on SYSTEM privileges. If the parameter is set to true, access to objects in the SYS schema is allowed (Oracle7 behavior). The default setting of false ensures that system privileges that allow access to objects in "any schema" do not allow access to objects in SYS schema.
For example, if O7_DICTIONARY_ACCESSIBILITY = false, then the SELECT ANY TABLE privilege allows access to views or tables in any schema except the SYS schema (data dictionary tables cannot be accessed). The system privilege EXECUTE ANY PROCEDURE allows access on the procedures in any schema except the SYS schema.
If this parameter is set to false and you need to access objects in the SYS schema, then you must be granted explicit object privilege. Also, the following roles, which can be granted to the database administrator, also allow access to dictionary objects: SELECT_CATALOG_ROLE, EXECUTE_CATALOG_ROLE, and DELETE_CATALOG_ROLE."