OGG -使用CMDSEC 文件限制某个系统用户对OGG 进行特定命令操作。

You can establish command security for Oracle GoldenGate to control which users have

access to which Oracle GoldenGate functions. For example, you can allow certain users to

issue INFOand STATUScommands, while preventing their use of STARTand STOPcommands.

Security levels are defined by the operating system’s user groups.

To implement security for Oracle GoldenGate commands, you create a CMDSECfile in the

Oracle GoldenGate directory. Without this file, access to all Oracle GoldenGate commands

is granted to all users.

To implement command security

1. Open a new ASCII text file.

2. Referring to the following syntax and the example on page 135, create one or more

security rules for each commandthat you want to restrict, one rule per line. List the

rules in order from the most specific (those with no wildcards) to the least specific.

Security rules are processed from the top of the CMDSEC file downward. The first rule

satisfied is the one thatdetermines whether or not access is allowed.

Separate each of the following components with spaces or tabs.

Where:

? is a GGSCI command name or a wildcard, for example STARTor STOP

or *.

? is any GGSCI command objector a wildcard, for example EXTRACT

or REPLICATor MANAGER.

? is the name of a Windows or UNIX user group. On a UNIX system, you

can specify a numeric group ID instead ofthe group name. You can use a wildcard

to specify all groups.

? is the name of a Windows or UNIX user. On a UNIX system, you can

specify a numeric user ID instead of the user name. You can use a wildcard to

specify all users.

? specifies whether access to the command is granted or prohibited.

3. Save the file as CMDSEC(using upper case letters on a UNIX system) in the Oracle

GoldenGate home directory.

The following example illustrates the correct implementation of a CMDSECfile on a UNIX

system.
-------------------------------------------------------------------------------------------------------------------------------
1、 GGSCI (OGG1) 2> status extract ggex
EXTRACT GGEX: RUNNING
2、 [oracle@OGG1 ogg]$ vi CMDSEC 
[oracle@OGG1 ogg]$ more CMDSEC 
STATUS EXTRACT * oracle NO
3、 GGSCI (OGG1) 2> status extract ggex
ERROR: Command not authorized for this user.
-----------------------------------------------------------------------------------------------------------------------------------

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/26764973/viewspace-1176434/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/26764973/viewspace-1176434/