一.創建用戶.角色和表
1.用戶登錄和退出
登錄方式：
sqlplus sys/oracle@orcl as sysdba -- sys具有sysdba權限，需要加上 as sysdba
sqlplus scott/tiger@orcl --普通用戶登陸
退出：
SQL>disc
2.表空間
參考：
http://www.oracle.com/pls/tahiti/tahiti.tabbed?section=75124
例子：
DEFAULT Storage Example
This statement creates a tablespace namedtabspace_2 with one datafile:
CREATE TABLESPACE tabspace_2
DATAFILE 'diska:tabspace_file2.dat' SIZE 20M
DEFAULT STORAGE (INITIAL 10K NEXT 50K
MINEXTENTS 1 MAXEXTENTS 999)
ONLINE;
AUTOEXTEND Example
This statement creates a tablespace namedtabspace_3 with one datafile. When more space is required, 50 kilobyte extents will be added up to a maximum size
of 10 megabytes:
CREATE TABLESPACE tabspace_5
DATAFILE 'diskb:tabspace_file3.dat' SIZE 500K REUSE
AUTOEXTEND ON NEXT 500K MAXSIZE 10M;
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
創建實驗使用缺省表空間:
Admin表
CREATE TABLESPACE TAdmin
DATAFILE 'C:\oraclexe\oradata\XE\admin.dbf' SIZE 20M
DEFAULT STORAGE ( INITIAL 64K NEXT 64K MAXEXTENTS UNLIMITED PCTINCREASE 50 );
Teacher表
CREATE TABLESPACE TTeacher
DATAFILE 'C:\oraclexe\oradata\XE\teacher.dbf'
SIZE 2M
DEFAULT STORAGE ( INITIAL 64K NEXT 64K MAXEXTENTS UNLIMITED PCTINCREASE 50 );
Student表
CREATE TABLESPACE TStudnet
DATAFILE 'C:\oraclexe\oradata\XE\student.dbf' SIZE 2M
DEFAULT STORAGE ( INITIAL 64K NEXT 64K MAXEXTENTS UNLIMITED PCTINCREASE 50 );
備註:
在Oracle中，命令和對象名稱都是大小寫不敏感的，因爲Oracle在處理語句時，將所有的名稱和命令全部轉化爲大寫。
但是對於字符串中的字符，無論是比較還是排序，都是大小寫敏感的。這在Oracle是默認方式，但不是唯一的方式。
3.角色和用戶
（1）創建profile:
備註：
http://download.oracle.com/docs/cd/B19306_01/server.102/b14200/statements_6010.htm#i2065930
http://psoug.org/reference/profiles.html
Admin:
CREATE PROFILE admin_profile LIMIT
SESSIONS_PER_USER UNLIMITED
CPU_PER_SESSION UNLIMITED
FAILED_LOGIN_ATTEMPTS 3
PASSWORD_GRACE_TIME 30
PASSWORD_REUSE_MAX 100;
teacher:
CREATE PROFILE teacher_profile LIMIT
SESSIONS_PER_USER 2
IDLE_TIME 30
CONNECT_TIME 60;
CREATE PROFILE student_profile LIMIT
SESSIONS_PER_USER 1
IDLE_TIME 30
CONNECT_TIME 60;
（2）創建用戶
備註：
http://download.oracle.com/docs/cd/B19306_01/network.102/b14266/admusers.htm
系統管理員（admin）:
CREATE USER admin IDENTIFIED BY admin
DEFAULT TABLESPACE TAdmin
QUOTA 500K ON users
PROFILE admin_profile;
GRANT DBA TO admin;
alter user admin profile admin_profile;
教師（teacher）:
CREATE USER teacher1 IDENTIFIED BYteacher1
DEFAULT TABLESPACE TTeacher
QUOTA 500K ON users
PROFILE teacher_profile;
GRANT CONNECT TO teacher1;
alter user teacher1 profile teacher_profile;
學生（student）:
CREATE USER wuxueyi IDENTIFIED BY wuxueyi
DEFAULT TABLESPACE TStudent
QUOTA 500K ON users
PROFILE student_profile;
GRANT CONNECT TO wuxueyi;
alter userwuxueyi profilestudent_profile;
（3）建表
1.
CREATE TABLE TeacherInfo
(
teacherID Char(18) NOT NULL,
teacherName Char(20) NOT NULL,
DepartmentCode Char(5) NOT NULL,
SEX Char(1) NOT NULL,
teacherBrief Varchar2(255) NULL,
Tel Char(20) NULL,
Fax Char(20) NULL,
CONSTRAINT pk_TeacherInfo_Id PRIMARY KEY (teacherID)
);
2.
CREATE TABLE CourseInfo
(
courseID Varchar2(8) NOT NULL,
courseName Varchar2(32) NOT NULL,
DepartmentCode Varchar2(5) NOT NULL,
credit Number(3,1) NOT NULL,
Resume Varchar2(255) NULL,
CONSTRAINT pk_CourseInfo_Id PRIMARY KEY (courseID)
);
(
departmentCode Char(4) NOT NULL,
departmentName Char(32) NOT NULL,
CONSTRAINT pk_DepartmentInfo_Id PRIMARY KEY (departmentCode)
);
4.
CREATE TABLE SelectiveInfo(
studentID Char(18) NOT NULL,
classID Number(10,0) NOT NULL,
grade Number(4,2) NULL,
selectiveDate Date NOT NULL,
status Int,
CONSTRAINT pk_SelectiveInfo_Id PRIMARY KEY (studentID,classID)
);
5.
CREATE TABLE ClassInfo
(
classID Number(10,0) NOT NULL,
className Varchar2(32),
teacherID Char(18) NOT NULL,
courseID Char(8) NOT NULL,
classYear Char(6) NULL,
ClassTimePlace VarChar2(128) NULL,
CONSTRAINT pk_ClassInfo_Id PRIMARY KEY(classID),
CONSTRAINT FK_ClassInfo_TeacherInfo FOREIGN KEY (teacherID) REFERENCES TeacherInfo(teacherID),
CONSTRAINT FK_ClassInfo_ClassInfo FOREIGN KEY (classID) REFERENCES ClassInfo(classID),
CONSTRAINT FK_ClassInfo_DepartmentInfo FOREIGN KEY (departmentCode) REFERENCES DepartmentInfo(DepartmentCode)
);6.
CREATE TABLE StudentInfo
(
studentID Char(18) NOT NULL,
studentName Char(40) NOT NULL,
sex Char(2) NULL,
departmentCode Char(5) NOT NULL,
Address Varchar2(200),
Tel Varchar2(20),
Fax Varchar2(20),
CONSTRAINT pk_StudentInfo_Id PRIMARY KEY (courseID),
CONSTRAINT FK_StudentInfo_DepartmentInfo FOREIGN KEY (departmentCode) REFERENCES DepartmentInfo(departmentCode)
);
（4）分配權限
備註：
http://download.oracle.com/docs/cd/B10501_01/server.920/a96521/privs.htm
http://www.adp-gmbh.ch/ora/sql/grant.html
http://www.techonthenet.com/oracle/grant_revoke.php
http://www.orafaq.com/wiki/Oracle_database_Security_FAQ
http://psoug.org/reference/roles.html
並不是所有的DML操作都支持授權到列，只有INSERT、UPDATE和REFERENCES權限支持到列：
教師權限：
grant select on studentinfo to teacher1
grant select on teacherinfo to teacher1
grant update on teacherinfo to teacher1
grant select on courseinfo to teacher1
grant select, update on selectiveInfo to teacher1
grant select on DepartmentInfo to teacher1
學生權限：
grant select on StudentInfo to wuxueyi
grant select on CourseInfo to wuxueyi
grant select on SelectiveInfo to wuxueyi
二.權限管理及安全信息查詢
1)系統管理員admin登錄選課系統數據庫，登錄三次失敗，第四次輸入正確的密碼進行登錄，會出現什麼情況？爲什麼？
2)使teacher1具有創建數據表系統權限，以用戶teacher1登錄，創建一個部門代碼表DepartmentInfo作爲系統管理員創建的選課信息表的備份；
分配權限：
grant create table to teacher1
grant resource to teacher1
建表：
CREATE TABLE DepartmentInfo
(
departmentCode Char(4) NOT NULL,
departmentName Char(32) NOT NULL,
CONSTRAINT pk_DepartmentInfo_Id PRIMARY KEY (departmentCode)
);
3)用戶teacher1登錄，分配學生用戶（你的名字的拼音）查看teacher1. DepartmentInfo記錄的權限；學生用戶登錄，查看teacher1. DepartmentInfo中的記錄；
grant select on DepartmentInfo to wuxueyi;
wuxueyi帳號登錄：
select * from teacher1.departmentInfo
4)取消用戶teacher1創建數據表權限；取消學生用戶查看teacher1. DepartmentInfo記錄的權限；
revoke select on DepartmentInfo from wuxueyi;
revoke create table from teacher1
revoke resource from teacher1
5)從數據庫中刪除用戶teacher1
drop user teacher1 cascade
6)創建密碼驗證函數，要求密碼至少包含大小寫字母、數字和特殊字符（@#$%）中的一個，並且不少於8位。然後將該密碼驗證函數應用於學生用戶並驗證效果（可選）
三.數據庫審計
備註：
http://www.th7.cn/Article/sj/ora/200910/367566.html
http://rake.itpub.net/post/4038/24963
http://download.oracle.com/docs/cd/B10501_01/server.920/a96521/audit.htm#1108
首先打開審計
Audit_trail：
None：是默認值，不做審計；
DB：將audit trail 記錄在數據庫的審計相關表中，如aud$，審計的結果只有連接信息；
DB,Extended：這樣審計結果裏面除了連接信息還包含了當時執行的具體語句；
OS：將audit trail 記錄在操作系統文件中，文件名由audit_file_dest參數指定；
XML：10g裏新增的。
1) 審計所有查詢選課消息表（admin.selectiveInfo）的操作；
AUDIT SELECT ON admin.selectiveInfo
2) 審計用ADMIN創建數據表的操作；
Audit create any table by admin
3) 審計所有數據更新操作；
Audit update any table by access