FAQ: Oracle Database 12.1 Oracle Home User On Windows (文档 ID 1529702.1)

FAQ: Oracle Database 12.1 Oracle Home User On Windows (文档 ID 1529702.1)
oracle数据库12.1 oracle的家庭用户 

In this Document 
Purpose
Questions and Answers
  1. What is Oracle Home User account?
            是什么oracle的家庭用户账户？
  2. What is the purpose of introducing Oracle Home User account?
            介绍家庭用户账户的目的是什么？
  3. Who can be Oracle Home User?
            谁是oracle的家庭用户？
  4. What are Windows Built-in user accounts?
            什么是内置用户帐户的窗口？
  5. How Oracle Home User can be associated to Oracle Home?
            如何用oracle家庭用户可以关联到oracle的家庭？
  6. How to create Oracle Home User in silent installation?
            在静默安装时怎么创建oracle家庭用户？
  7. What are the roles of Oracle Home User?
           oracle家庭用户是什么样的角色？  
  8. Can Oracle Home User be used to apply patches  to the Oracle Home?    
           oracle家用户能用来应用补丁到oracle主页吗
  9. Which services will not be running with Oracle Home User privileges?
          有家庭用户的权利哪种服务将不被运行
  10. What are the default permissions of Oracle Home User on Oracle Home?
           在oracle家庭中，什么是oracle家庭用户默认的许可
  11. What Groups are created by OUI during installation?
           在安装期间什么群组被oui创建
  12. What groups is the Oracle Home User a member of by default?
        什么群组是oracle家庭用户默认的oracle家庭用户
  13. Is it possible to Change Oracle Home User after installing the software?
         在安装完软件后，可能改变oracle的家庭用户吗？
References
参考
APPLIES TO:
应用于


Oracle Database - Standard Edition - Version 12.1.0.1 and later
Oracle Database - Enterprise Edition - Version 12.1.0.1 and later
Oracle Database Configuration Assistant - Version 12.1.0.1 to 12.1.0.1 [Release 12.1]
Microsoft Windows x64 (64-bit)
PURPOSE
目的
To provide answers to common questions regarding the New 12c Feature "Oracle Home User" on WINDOWS platform.
提供答案给共同的问题 关于新的12c 特点 oracle的家庭用户 在windows 平台 
QUESTIONS AND ANSWERS


1. What is Oracle Home User account?
 是什么oracle的家庭用户账户？
Oracle Home User account is a low privileged non-administrator account, which is to host  Oracle Services.  Oracle services use Oracle Home User privileges.
oracle家庭用户账户是一个低权利的没有管理员的账户，支持着oracle服务。oracle服务使用oracle家庭用户权利。
2. What is the purpose of introducing Oracle Home User account?
去介绍家庭用户账户的目的是什么？
In prior releases, all Oracle Services are running with Local System privileges, which is a very high-privileged built-in account.
在先前的释放里，所有的oracle服务运行都是有本地系统权限的，本地的系统权限是一个 很高的权限 建立的账户
Therefore anyone gaining unauthorized access to the server via the Oracle Service did so with complete privileges.
因此，任何一个人使非法的服务渠道，到oracle服务，有完全的权利
To avoid this security vulnerability, a low privileged non-administrator account, Oracle Home User is introduced to host Oracle Services.
为了避免这个安全的弱点，一个低的权限管理员账户，oracle家庭用户被介绍去支持oracle服务。
3. Who can be Oracle Home User?
 谁是oracle的家庭用户？
Any local or domain user without admin privileges, a built-in account, or an  a MSA account can be Oracle Home User. 
任何当地的或者其他领域的用户，没有管理权限的，一个内置的账户，或一个MSA账户能成为oracle家庭用户。
If DBA prefers built-in account as Oracle Home User, then all Oracle services will be running with Local System Privileges.
如果一个DBA 喜欢用内置的账户作为oracle的家庭用户，所有oracle服务将在有本地系统服务权限上运行。
4. What are Windows Built-in user accounts?
 什么是内置用户帐户的窗口
Local System account is a very high-privileged built-in account. 
本地系统账户是一个权限很高的内置账户。
It has extensive privileges on the local system and acts as the computer on the network. 
在本地系统有大量的权限，行为就像电脑在网络上，
The actual name of the account is "NT AUTHORITY\SYSTEM".
实际的账户的名字是NT AUTHORITY\SYSTEM
Local Service account is a built-in account that has the same level of access to resources and objects as members of the Users group. 
本地服务帐户是一个内置的帐户，具有与用户组的成员相同级别的资源和对象的访问级别。
This limited access helps safeguard the system if individual services or processes are compromised.
被限制的通道帮助保护系统安全，如果个人的服务或程序被损坏。
Services that run as the Local Service account access network resources as a null session without credentials.
服务在本地服务账户通过网络资源像一个空的没有证书的会话。 
Be aware that the Local Service account is not supported for  SQL Server or SQL Server Agent services. 
要意识到本地的服务账户是不支持SQL Server 或 SQL Server代理服务的
The actual name of the account is "NT AUTHORITY\LOCAL SERVICE".
这个账户真实的名字是"NT AUTHORITY\LOCAL SERVICE"
Network Service account is a built-in account that has more access to resources and objects than members of the Users group.
网络服务账户是一个内置的账户，比用户群组的成员有更多的资源和物体。
Services that run as the Network Service account access network resources by using the credentials of the computer account. 
使用计算机帐户的凭据运行作为网络服务帐户访问网络资源的服务。
The actual name of the account is "NT AUTHORITY\NETWORK SERVICE".
这个账户真实的名字是"NT AUTHORITY\NETWORK SERVICE"
5. How Oracle Home User can be associated to Oracle Home?
 如何用oracle家庭用户可以关联到oracle的主页？
During installation OUI provides three options to associate an Oracle Home User to the Oracle Home:
在安装OUI提供三个点去连接到oracle家庭用户到oracle家庭
1. Let OUI create a new user account to be made as Oracle Home User. 
让OUI创建一个新的用户账户去当做oracle家庭用户
Selecting this option the newly created user will not have login privileges to the server. 
选择此选项，新创建的用户将不具有服务器的登录权限
This can only be used for Single Instance databases.
这个仅被用作单一实例数据库
2. Select an existing local or domain account to be the Oracle Home User.
 选择一个现有的本地或域帐户为oracle家庭用户
If the existing account has login privileges, then Oracle Home User will have login privileges to the server. 


如果现有的帐户具有登录权限，那么oracle家庭用户将有登录服务器的权限。
This should be a non adminstrator user.
这应该是一个非管理员用户
3. Select a built-in account to be the Oracle Home User.


选择一个内置的帐户将是oracle家庭用户
In this option Local System/Local Service built-in account will become Oracle Home user.


在这个选项中，本地系统/本地服务内置的帐户将成为oracle家庭用户
6. How to create Oracle Home User in silent installation?
    在静默安装时怎么创建oracle家庭用户？
Following are the parameters for creating Oracle Home User in silent installation.


以下是在静默安装中创建oracle家庭用户的参数
12c introduces these new variable names:


oracle.install.IsBuiltInAccount= false | true 
oracle.install.OracleHomeUserName= 
oracle.install.OracleHomeUserPassword=


Eg:


oracle.install.IsBuiltInAccount= false
oracle.install.OracleHomeUserName= <homeuser>
oracle.install.OracleHomeUserPassword=<password> ( ** Note: password can be passed in the shell using -promptForPassword flag )


Note:
Set oracle.install.IsBuiltInAccount to true if you want to use Built-In Account, if not set it false.
Invoke setup.exe with "-promptForPassword flag", if you do not want to embed the password in the response file.


Example of invoking OUI in 12c for Silent Installation Without Response File:


setup.exe -silent -debug -promptForPassword ^
oracle.install.option=INSTALL_DB_SWONLY ^
ORACLE_HOSTNAME=WIN-OQ40SUNBJQU ^
INVENTORY_LOCATION=”C:\Program Files\Oracle\Inventory” ^
SELECTED_LANGUAGES=en ^
ORACLE_HOME=E:\app\homeowner4\product\12.1.0\dbhome_1 ^
ORACLE_BASE=E:\app\homeowner4 ^
oracle.install.db.InstallEdition=EE ^
oracle.install.IsBuiltInAccount=false ^
oracle.install.OracleHomeUserName=homeowner4 ^
SECURITY_UPDATES_VIA_MYORACLESUPPORT=false ^
DECLINE_SECURITY_UPDATES=true ^
oracle.installer.autoupdates.option=SKIP_UPDATES


(Note: Character '^' is command continuation character in Windows Command prompt)


7. What are the roles of Oracle Home User?
  oracle家庭用户是什么样的角色？
Though the Oracle Home User owns the Oracle Home directory, it should not be used to administer the Oracle Home. 
虽然oracle的家庭用户拥有了oracle的主目录，但它不应该被用来管理oracle的主页
Since most of Oracle Services are running with Oracle Home User privileges, this user can stop and start the services in part or in total. 
由于大多数的oracle服务都运行与oracle家庭用户权限，用户可以停止并开始在部分或总的服务
Oracle administrative tasks must use an administrator account per Oracle documentation (site reference guide). 
管理任务必须使用每一个oracle文档的管理员帐户
The Oracle Home User account is only to be used for hosting oracle services with low privileges to avoid potential threats to the server hosting Oracle Database.
在oracle家庭用户帐户是只用于管理与低权限的oracle服务，以避免潜在的威胁到托管oracle数据库的服务器
8. Can Oracle Home User be used to apply patches  to the Oracle Home?
     oracle家用户能用来应用补丁到oracle主页吗
Oracle Home User only has permission on Oracle Home directory, it does not have any permissions on the Central Inventory. 
家庭用户只有在主目录上的权限，它没有中央库存的任何权限。
So it cannot be used to apply any patches on Oracle Home
 所以它不能被用来在oracle上应用任何补丁
It is not supported to apply any patches on the Oracle Home using this account.
 不支持在使用此帐户的oracle上应用任何补丁
All patching and upgrading has to be done by the same user with administrator privileges that installed the Oracle Home.
所有修补和升级都必须由同一个具有管理员权限的用户来完成，这些用户可以安装在oracle的家庭中。
9. Which services will not be running with Oracle Home User privileges?
有家庭用户的权利哪种服务将不被运行？
Oracle Collection Manager (OCM) and Listener Services will not be running with Oracle Home User privileges. 
OCM和侦听器服务将不会运行与oracle家庭用户特权
Listener service requires the least privileges on system and hence it will run as LocalService.
侦听器服务需要系统的最小特权，因此它会运行本地服务。
OCM needs system level privileges and hence it will still be running as Local System.
OCM需要系统级权限，因此仍将运行本地系统。
10. What are the default permissions of Oracle Home User on Oracle Home?
  在oracle家庭中，什么是oracle家庭用户默认的许可？
Oracle Home User has full control on Oracle Home directory. 
oracle家庭用户能完全能控制在oracle主页的目录
Since Oracle services are running with this accounts privileges it needs access to most binaries in Oracle Home.
由于oracle服务正在运行此帐户的特权，它需要访问在oracle家中的大多数二进制文件。
11. What Groups are created by OUI during installation?
 在安装期间什么群组被oui创建？
The following groups will be created by OUI:
以下群组将被OUI创建：
ORA_ASMDBA ( Default Members, Installed user )
ORA_ASMOPER ( Default Members, None )
ORA_CLIENT_LISTENERS ( Default Members, None )
ora_dba ( Default Members, Installed user )
ORA_GRID_LISTENERS ( Default Members, None )
ORA_INSTALL ( Default Members, Oracle Home User )
ORA_OPER ( Default Members, None )
ORA_<oracle home name>_DBA  ( Default Members, Oracle Home User )
ORA_<oracle home name>_OPER ( Default Members, None )
ORA_<oracle home name>_SYSBACKUP ( Default Members, Installed user )
ORA_<oracle home name>_SYSDG ( Default Members, Installed user )
ORA_<oracle home name>_SYSKM ( Default Members, Installed user )


12. What groups is the Oracle Home User a member of by default?
什么群组是oracle家庭用户默认的oracle家庭用户
ORA_INSTALL 
ORA_<oracle home name>_DBA
 


13. Is it possible to Change Oracle Home User after installing the software?
 在安装完软件后，可能改变oracle的家庭用户吗？
It is not possible.To change Oracle Home User ,you need to reinstall the oracle software.
这是不可能的。要更改oracle家庭用户，您需要重新安装oracle软件。
REFERENCES


NOTE:1351051.1 - Information Center: Install and Configure Database Server/Client Installations
NOTE:1520299.1 - Master Note For Oracle Database 12c Release 1 (12.1) Database/Client Installation/Upgrade/Migration Standalone Environment (Non-RAC)