Root access for SAP administrator - required or not?

[peter_amant]

Dear SAP administrators,

More and more our SAP Basis Administration team is subject of dispute because of the usage of root access to perform SAP installations, upgrades, kernel patches, oracle installations etc.

We already use sudo access but with the sudo -su command to create a shell in which we can do +/- whatever we want. Our unix administrators are not happy with this situation and demand we are no longer using the -su addition.

We are however wondering if this works for SAP related administration purposes. Has anyone some experience with this?

Alternatively we've found some information on wrapping scripts that also could help to overcome the usage of the sudo -su. But as there are several activities we can perform, there must be several wrapper scripts developed (R3up, kernel packages, BR* programs , Oracle installers etc.). I can imagine that the support effort will increase if we have to create and maintain these wrapping scripts manually.

As I think many of you must face these kind of issues I'm wondering how you deal with them? Can you give concrete examples of wrapper scripts or methods you use to avoid the usage of root or sudo -su access?

Many thanks in advance for your advice.

Peter

[former_member204746]

except for installation, root access is not needed.

SUDO is very useful though.

your Unix admin can decide which commands you are allowed to run with SUDO. Talk with him, ask him the basic commands that you might need to run as ROOT. one of them is saproot.sh.

[peter_amant]

Eric,

This is exactly the problem: also for installing SAP products sudo -su is now forbidden. I can imagine it's not done to change the installation scripts to put sudo in front of all commands.

I heard about something called wrapped scripts that maybe could help but it would be useful to get some examples specific for SAP installations.

Peter

Edited by: Peter Amant on Aug 26, 2010 4:20 PM

[former_member204746]

I was not talking about sudo -su

I was talking about using sudo such as:

sudo /usr/sap/PRD/SYS/exe/run/saproot.sh

your Unix admin can accept a few specific commands that are allowed to be used for your user.