Configuring Users, Groups and Environments for Oracle Grid Infrastructure and Oracle Database

Before installation, create operating system groups and users, and configure user environments.

Required Operating System Groups and Users

Oracle installations require an installation owner, a shared Oracle Inventory group as the primary group for installation owners, and at least one system-privileges group. Administrators should verify whether an existing central inventory and oraInst.loc file are present, reuse the same inventory for all installations, and ensure installation owners can write to it. Create the inventory group if necessary, typically oinstall, and configure grid for Grid Infrastructure or oracle for Database installations, ensuring the appropriate primary and secondary group memberships. The oraInventory directory should not be placed under the Oracle base directory.

Oracle Installations with Standard and Job Role Separation Groups and Users

Oracle supports standard configurations that share administrative users and groups, as well as job role separation configurations that assign distinct users and operating system groups to Grid Infrastructure, ASM, and individual databases. The required OSDBA group, typically dba, grants SYSDBA privileges, while optional or extended groups such as oper, backupdba, dgdba, kmdba, and racdba provide specialized privileges. ASM commonly uses separate asmadmin, asmoper, and asmdba groups, and the ASMSNMP user can provide limited monitoring access. Role separation improves security but does not prevent software owners from starting or stopping shared Clusterware resources.

Creating Operating System Privileges Groups

This page defines the operating system groups required or commonly used for Oracle administration and provides representative groupadd commands. ASM installations may require asmadmin for SYSASM, asmdba for ASM disk-device access, and optionally asmoper for ASM startup and shutdown. Database installations require dba for SYSDBA and may use oper for SYSOPER, while backupdba, dgdba, kmdba, and racdba provide SYSBACKUP, SYSDG, SYSKM, and SYSRAC privileges respectively. Administrators should reuse existing groups where appropriate or create distinct groups for separated administrative roles.

Creating Operating System Oracle Installation User Accounts

Before installation, create and configure Oracle software owner accounts such as oracle and grid, assigning the Oracle Inventory group oinstall as the primary group and the required database or ASM privilege groups as secondary groups. Example commands demonstrate memberships for database and Grid Infrastructure owners. Existing accounts can be updated with usermod, but their primary inventory group must not be changed and all Oracle software owners must share the same central inventory group to avoid inventory corruption. Record each installation user’s UID for preinstallation tasks.

Configuring Software Owner User Environments

Oracle installation owners must have correctly configured shell environments before running the installer. Set umask 022, configure suitable file-descriptor and process limits, establish DISPLAY for graphical installations, and remove conflicting Oracle variables such as ORACLE_HOME, ORACLE_BASE, ORACLE_SID, ORA_NLS10, TNS_ADMIN, and ORA_CRS_HOME; also remove Oracle home paths from PATH. If /tmp lacks sufficient space, configure TMP and TMPDIR on a local filesystem with at least 1 GB available, not a shared filesystem for RAC. Reload the shell profile and verify the environment and umask values before installation.

Checking Resource Limits for Oracle Software Installation Users

Each Oracle installation owner must meet recommended shell resource limits: at least 1,024 soft and 65,536 hard open files, 2,047 soft and 16,384 hard processes, and a stack size of at least 10,240 KB with a maximum hard limit of 32,768 KB. Locked memory should be at least 90 percent of RAM with HugePages or at least 3 GB without HugePages, and is unlimited on Exadata. Check limits using ulimit, adjust distribution-specific security configuration such as /etc/security/limits.conf when necessary, and have affected users log out and back in for changes to take effect.

Creating Oracle Database Vault User Accounts

Deployments that enable Oracle Database Vault by default must create and configure a Database Vault Owner account before using the feature, with an optional separate Account Manager administrative account. Database Vault establishes baseline auditing for security configuration, Oracle Catalog information, system privilege use, and Oracle Label Security settings, while initializing security-related database parameters with default values.
Read More: Creating Oracle Database Vault User Accounts