Oracle 11g R2 RAC 安装时 系统用户组 配置 说明

Oracle 安装用户组的创建在官方文档有说明，这里把这部分内容单独拿出来说明一下。

一.官网说明

From：http://docs.oracle.com/cd/E11882_01/rac.112/e17264/preparing.htm#TDPRC129

1.1 Required Operating System Users and Groups

To install theOracle Grid Infrastructure for a cluster software and Oracle RAC, you mustcreate the following operating system groups and users:

（1）The Oracle Inventory group(typically,oinstall) for all installations. The Oracle Inventory groupmust be the primary group for Oracle software installation owners. Members ofthe Oracle Inventory group have access to the Oracle Inventory directory. Thisdirectory is the central inventory record of all Oracle software installationson a server and the installation logs and trace files from each installation.

（2）An Oraclesoftware owner. This is the user account you use when installing the software.

If you want to use a single software owner for all installations,then typically the user name isoracle. If you plan to install the OracleGrid Infrastructure for a cluster and the Oracle RAC software using separatesoftware owners to separate Oracle Grid Infrastructure for a clusteradministrative privileges from Oracle Database administrative privileges, thentypically you would usegridfor the Oracle Grid Infrastructure for acluster software owner andoraclefor the Oracle RAC software owner.

--如果安装单实例，创建一个oracle 用户就可以了，如果是安装RAC，则需要在创建一个集群的用户，在安装grid。

（3）The OSDBA group(typically,dba) for Oracle Database authentication.

The OSDBA groupis a system privileges group whose members are granted the SYSDBA privilege toadminister Oracle Database and the SYSASM privilege to administer OracleClusterware and Oracle ASM. To provide fine-grained control of administrativeprivileges you can create multiple operating system groups as describedin"OptionalOperating System Users and Groups".

Note:

If installingOracle RAC on Microsoft Windows, then OUI automatically createstheORA_DBAgroup for authenticating SYSDBA access. Also, if youinstall the Oracle RAC software while logged in to an account withadministrative privileges, then you do not have to create a separate user forthe installation.

If you use oneinstallation owner for both Oracle Grid Infrastructure for a cluster and OracleRAC, then when you want to perform administration tasks, you must change thevalue forORACLE_HOMEenvironment variable to match the instance youwant to administer (Oracle ASM, in the Grid home, or a database instance in theOracle home).

--如果将grid 和 oracle 用同一个用户来安装，那么必须改变ORACLE_HOME变量的值。

To changetheORACLE_HOMEenvironment variable, use a command syntax similar tothe following example, where/u01/app/11.2.0/gridis the Oracle GridInfrastructure for a cluster home:

ORACLE_HOME=/u01/app/11.2.0/grid; exportORACLE_HOME

If you try toadminister an instance usingsqlplus,lsnrctl,orasmcmdcommands whileORACLE_HOMEis set to a differentbinary path, then you will encounter errors. The Oracle home path does notaffectsrvctlcommands.

1.2 Separate Operating System Users and Groups for Oracle Software Installations

Instead of usinga single operating system user as the owner of every Oracle softwareinstallation, you can use multiple users, each owning one or more Oraclesoftware installations. A user created to own only the Oracle GridInfrastructure for a cluster installation is called thegriduser.This user owns both the Oracle Clusterware and Oracle Automatic StorageManagement binaries. A user created to own either all Oracle softwareinstallations (including Oracle Grid Infrastructure for a cluster), or onlyOracle Database software installations, is called theoracleuser.

You can also usedifferent users for each Oracle Database software installation. Additionally,you can specify a different OSDBA group for each Oracle Database softwareinstallation. By using different operating system groups for authenticatingadministrative access to each Oracle Database installation, usershaveSYSDBAprivileges for the databases associated with their OSDBAgroup, rather than for all the databases on the system.

Members of theOSDBA group can also be granted theSYSASMsystem privilege, whichgives them administrative access to Oracle ASM. As described in the nextsection, you can configure a separate operating system group for Oracle ASMauthentication to separate users withSYSASMaccess to the Oracle ASMinstances from users withSYSDBAaccess to the database instances.

If you want tocreate separate Oracle software owners so you can use separate users andoperating system privilege groups for the different Oracle softwareinstallations, then note that each of these users must have the Oracle centralinventory group (oinstall) as their primary group. Members of this group havethe required write privileges to the Oracle Inventory directory.

Note:

The Oracle GridInfrastructure for a cluster software installation can be owned by only oneuser. You cannot have one user that owns the Oracle Clusterware softwareinstallation and a different user that owns the Oracle ASM software installation.

1.3 OptionalOperating System Users and Groups

You can createadditional users and groups to divide administrative access privileges to theOracle Grid Infrastructure for a cluster installation from other administrativeusers and groups associated with other Oracle installations. Separatingadministrative access is implemented by specifying membership in differentoperating system groups, and separating installation privileges is implementedby using different installation owners for each Oracle installation.

The optional users and groups you cancreate are:

（1）The Oracle Automatic StorageManagement Group, or OSASM group (typicallyasmadmin). Create this groupas a separate group if you want to have separate administration privilege groupsfor Oracle ASM and Oracle Database administrators. Members of the OSASM groupcan use SQL to connect to an Oracle ASM instance asSYSASMusingoperating system authentication. TheSYSASMprivileges permitmounting and dismounting disk groups, and other storage administration tasks. SYSASMprivilegesdo not provide access privileges to an Oracle Database instance. If you do notcreate a separate OSASM group, then the OSDBA group (dba)is the OSASMgroup.

（2）The ASMDatabase Administrator group (OSDBA for ASM group, typicallyasmdba).Members of the OSDBA group for Oracle ASM are granted read and write access tofiles managed by Oracle ASM. The Oracle Grid Infrastructure for a clusterinstallation owner and all Oracle Database software owners (for example,oracle)must be a member of this group, and all users with OSDBA membership fordatabases that require access to the files managed by Oracle ASM should bemembers of the OSDBA for ASM group.

（3）The OSOPER for Oracle Databasegroup (typically,oper). Create this group if you want certain operatingsystem users to have a limited set of database administrative privileges(theSYSOPERprivilege). Members of the OSDBA group automaticallyhave all privileges granted by theSYSOPERprivilege.

（4）The OSOPERfor Oracle ASM group (typicallyasmoper). Members of this group aregranted access to a subset of theSYSASMprivileges, such as startingand stopping the Oracle ASM instance.

1.4 Configuring Operating System Users and Groups

In this guide, asingle software owner is used for all installations, namedoracle.Theoracleuser belongs totheoinstallanddbaoperating system groups.

To create one software owner with all operating system-authenticated administrationprivileges:

（1）Determine thegroups that exist on your server by listing the contents ofthe/etc/groupfile.

cat /etc/group

（2）If this isthe first time Oracle software has been installed on your server, and theOracle Inventory group does not exist, then create the Oracle Inventory group(oinstall) with a group ID that is currently not in use on all the nodes inyour cluster. Enter a command as therootuser that is similar to thefollowing:

#/usr/sbin/groupadd -g 1000 oinstall

（3）Create anOSDBA (dba) group with a group ID that is currently not in use on all the nodesin your cluster by entering a command as therootuser that issimilar to the following:

#/usr/sbin/groupadd -g 1001 dba

（4）If the user that owns the Oracle software (oracle) does not exist onyour server, then you must create the user. Select a user ID (UID) that iscurrently not in use on all the nodes in your cluster. To determine which usershave been created on your server, list the contents ofthe/etc/passwdfile using the command:

cat /etc/passwd

The followingcommand shows how to create theoracleuser and the user's homedirectory (/home/oracle) with the default group asoinstalland thesecondary group asdba, using a UID of 1100:

# useradd -u1100 –g oinstall -G dba -d /home/oracle -r oracle

（5）Set thepassword for theoracleaccount using the following command.Replacepasswordwith your own password.

passwd oracle

Changing password for user oracle.

New UNIX password: password

retype new UNIX password: password

passwd:all authentication tokens updated successfully.

（6）Repeat Step 1through Step 5 on each node in your cluster.

（7）Verify thatthe attributes of the useroracleare identical on each node of yourcluster:

id oracle

The command output should be similar to thefollowing:

uid=1100(oracle) gid=1000(oinstall)groups=1000(oinstall),1001(dba)

二.其他说明

From：

http://www.oracle.com/technetwork/cn/articles/hunter-rac11gr2-iscsi-083834-zhs.html

上图这个基于Oracle 11gR2的一个用户组说明。

2.1 安装单实例时需要创建的几个groups：

（1）Oracle 清单组（一般为oinstall）

OINSTALL组的成员被视为 Oracle 软件的“所有者”，拥有对 Oracle 中央清单 (oraInventory) 的写入权限。在一个 Linux 系统上首次安装 Oracle 软件时，OUI 会创建/etc/oraInst.loc文件。该文件指定 Oracle 清单组的名称（默认为oinstall）以及 Oracle 中央清单目录的路径。

[root@rac1 ~]#cat /etc/oraInst.loc

inventory_loc=/u01/app/oraInventory

inst_group=oinstall

深入理解 OUI(Oracle Universal Installer)

http://blog.csdn.net/tianlesoftware/article/details/6901684

如果不存在 oraInventory 组，默认情况下，安装程序会将集群的网格基础架构的安装所有者的主组列为 oraInventory 组。确保所有计划的 Oracle 软件安装所有者都使用此组作为主组。

（2）数据库管理员（OSDBA，一般为dba）

OSDBA组的成员可通过操作系统身份验证使用 SQL 以SYSDBA身份连接到一个 Oracle 实例。该组的成员可执行关键的数据库管理任务，如创建数据库、启动和关闭实例。该组的默认名称为dba。SYSDBA系统权限甚至在数据库未打开时也允许访问数据库实例。对此权限的控制完全超出了数据库本身的范围。

不要混淆SYSDBA系统权限与数据库角色DBA。DBA角色不包括SYSDBA或SYSOPER系统权限。

（3）数据库操作员组（OSOPER，一般为oper）

OSOPER组的成员可通过操作系统身份验证使用 SQL 以SYSOPER身份连接到一个 Oracle 实例。这个可选组的成员拥有一组有限的数据库管理权限，如管理和运行备份。该组的默认名称为oper。SYSOPER系统权限甚至在数据库未打开时也允许访问数据库实例。对此权限的控制完全超出了数据库本身的范围。要使用该组，选择 Advanced 安装类型来安装 Oracle 数据库软件。

2.2 安装RAC集群时在单实例基础上添加的几个groups:

（1）Oracle 自动存储管理组（一般为asmadmin）

此组为必需组。如果想让 Oracle ASM 管理员和 Oracle Database 管理员分属不同的管理权限组，可单独创建此组。在 Oracle 文档中，OSASM组是其成员被授予权限的操作系统组，在代码示例中，专门创建了一个组来授予此权限，此组名为asmadmin。

OSASM组的成员可通过操作系统身份验证使用 SQL 以SYSASM身份连接到一个 Oracle ASM 实例。SYSASM权限是在 Oracle ASM 11g第 1 版 (11.1) 中引入的，现在，在 Oracle ASM 11g第 2 版 (11.2) 中，该权限已从SYSDBA权限中完全分离出来。SYSASM权限不再提供对 RDBMS 实例的访问权限。用SYSASM权限代替SYSDBA权限来提供存储层的系统权限，这使得 ASM 管理和数据库管理之间有了清晰的责任划分，有助于防止使用相同存储的不同数据库无意间覆盖其他数据库的文件。SYSASM权限允许执行挂载和卸载磁盘组及其他存储管理任务。

（2）ASM 数据库管理员组（OSDBA for ASM，一般为asmdba）

ASM 数据库管理员组（OSDBA for ASM）的成员是SYSASM权限的一个子集，拥有对 Oracle ASM 管理的文件的读写权限。Grid Infrastructure 安装所有者 (grid) 和所有 Oracle Database 软件所有者 (oracle) 必须是该组的成员，而所有有权访问 Oracle ASM 管理的文件并且具有数据库的OSDBA成员关系的用户必须是 ASM 的OSDBA组的成员。

（3）ASM 操作员组（OSOPER for ASM，一般为asmoper）

该组为可选组。如果需要单独一组具有有限的 Oracle ASM 实例管理权限（ASM 的 SYSOPER 权限，包括启动和停止 Oracle ASM 实例的权限）的操作系统用户，则创建该组。默认情况下，OSASM组的成员将拥有 ASM 的SYSOPER权限所授予的所有权限。

要使用 ASM 操作员组创建 ASM 管理员组（该组拥有的权限比默认的asmadmin组要少），安装 Grid Infrastructure 软件时必须选择 Advanced 安装类型。这种情况下，OUI 会提示您指定该组的名称。如果要拥有一个 OSOPER for ASM 组，则集群的 Grid Infrastructure 软件所有者 (grid) 必须为此组的一个成员。

2.3 为 Grid Infrastructure 创建组和用户

（1）在两个 Oracle RAC 节点上为 Grid Infrastructure 创建推荐的操作系统组和用户：

[root@racnode1 ~]# groupadd -g 1000oinstall
[root@racnode1 ~]# groupadd -g 1200 asmadmin
[root@racnode1 ~]# groupadd -g 1201 asmdba
[root@racnode1 ~]# groupadd -g 1202 asmoper
[root@racnode1 ~]# useradd -m -u 1100 -g oinstall -G asmadmin,asmdba,asmoper -d
/home/grid -s /bin/bash -c "Grid Infrastructure Owner" grid

[root@racnode1 ~]# id grid uid=1100(grid) gid=1000(oinstall)
groups=1000(oinstall), 1200(asmadmin), 1201(asmdba),1202(asmoper)

（2）设置grid帐户的口令：

[root@racnode1 ~]# passwd grid
Changing password for user grid.
New UNIX password:xxxxxxxxxxx
Retype new UNIX password:xxxxxxxxxxx
passwd: all authentication tokens updated successfully.

2.4 为 Oracle 数据库软件创建组和用户

（1）在两个 Oracle RAC 节点上为 Oracle 数据库软件创建推荐的操作系统组和用户：

[root@racnode1 ~]# groupadd -g 1300 dba
[root@racnode1 ~]# groupadd -g 1301 oper
[root@racnode1 ~]# useradd -m -u 1101 -g oinstall -G dba,oper,asmdba -d
/home/oracle -s /bin/bash -c "Oracle Software Owner" oracle

[root@racnode1 ~]# id oracle
uid=1101(oracle)
gid=1000(oinstall)
groups=1000(oinstall),1201(asmdba),1300(dba),1301(oper)

（2）设置oracle帐户的口令：

[root@racnode1 ~]# passwd oracle
Changing password for user oracle.
New UNIX password:
xxxxxxxxxxx
Retype new UNIX password:
xxxxxxxxxxx
passwd: all authentication tokens updated successfully.

2.5 验证用户 nobody 存在

安装软件之前，执行以下过程，以验证在两个 Oracle RAC 节点上存在用户nobody：

要确定该用户是否存在，输入以下命令：

# id nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)

如果该命令显示了nobody 用户的信息，则无需创建该用户。

如果用户nobody不存在，则输入以下命令进行创建：

# /usr/sbin/useradd nobody

在集群中的所有其他Oracle RAC 节点上重复此过程。

2.6 两个 Oracle RAC 节点最终的配置：

（1）Oracle 中央清单组，即 oraInventory 组 (oinstall)，其成员以中央清单组作为主组，拥有对 oraInventory 目录的写入权限。

（2）单独的OSASM 组(asmadmin)，其成员拥有 SYSASM 权限，可以管理 Oracle Clusterware 和 Oracle ASM。

（3）单独的ASM OSDBA 组(asmdba)，其成员包括grid和oracle，拥有对 Oracle ASM 的访问权限。

（4）单独的ASM OSOPER 组(asmoper)，其成员包括grid，拥有有限的 Oracle ASM 管理员权限（包括启动和停止 Oracle ASM 实例的权限）。

（5）集群的 Oracle 网格安装所有者(grid)，该用户以 oraInventory 组作为其主组，以 OSASM (asmadmin)、OSDBA for ASM (asmdba) 和 OSOPER for ASM (asmoper) 组作为其辅助组。

（6）单独的OSDBA 组(dba)，其成员拥有 SYSDBA 权限，可以管理 Oracle 数据库。

（7）单独的OSOPER 组(oper)，其成员包括oracle，拥有有限的 Oracle 数据库管理员权限。

（8）Oracle 数据库软件所有者(oracle)，该用户以 oraInventory 组作为其主组，以 OSDBA (dba)、OSOPER (oper) 和 OSDBA for ASM 组 (asmdba) 作为其辅助组。

（9）符合 OFA 的挂载点/u01，在安装之前，其所有者为grid:oinstall。

（10）网格的 Oracle 基目录/u01/app/grid，其所有者为grid:oinstall，权限设置为 775，在安装过程中其权限设置更改为 755。网格安装所有者的 Oracle 基目录是存放 Oracle ASM 诊断和管理日志文件的位置。

（11）网格主目录/u01/app/11.2.0/grid，其所有者为grid:oinstall，权限设置为 775 (drwxdrwxr-x)。这些权限为安装所需，在安装过程中会更改为root:oinstall和 755 权限设置 (drwxr-xr-x)。

（12）在安装过程中，OUI 在路径/u01/app/oraInventory下创建 Oracle 清单目录。此路径的所有者一直为grid:oinstall，使其他 Oracle 软件所有者可以写入中央清单。

（13）Oracle 基目录/u01/app/oracle，其所有者为oracle:oinstall，权限设置为 775。

-------------------------------------------------------------------------------------------------------

版权所有，文章允许转载，但必须以链接方式注明源地址，否则追究法律责任!

Blog: http://blog.csdn.net/tianlesoftware

Weibo: http://weibo.com/tianlesoftware

Email: [e-mail]

Skype: tianlesoftware

-------加群需要在备注说明Oracle表空间和数据文件的关系，否则拒绝申请----

DBA1 群：62697716(满); DBA2 群：62697977(满)DBA3 群：62697850(满)

DBA 超级群：63306533(满); DBA4 群：83829929 DBA5群： 142216823

DBA6 群：158654907 DBA7 群：172855474