创建数据库内部用户

root:
cat /etc/gbasedbt/allowed.surrogates
USERS:daemon
如果没此目录创建
mkdir /etc/gbasedbt
echo "USER:daemon" > /etc/gbasedbt/allowed.surrogates
chmod 644 /etc/gbasedbt/allowed.surrogates

gbasedbt:
onstat -c |grep USERMAPPING
onmode -wf USERMAPPING=ADMIN
onmode -cache surrogates
dbaccess sysuser -
create default user with properties user 'daemon';

---以上只做一次----------------------------------------------------

在操作系统gbasedbt用户的命令行下执行
su - gbasedbt

创建业务库对应的用户(dbuser1)
dbaccess sysuser -
create user dbuser1 with password 'GBase8s123';

创建业务库
create database db_yewu1 in datadbs1 with log;

database db_yewu1;

grant dba to dbuser1;

验证用户名及密码是否正确
connect to 'db_yewu1@gbase01' user 'dbuser1';

实际操作步骤:
[gbasedbt@dbhost1252 ~]$ dbaccess sysuser -
Your evaluation license will expire on 2026-02-08 00:00:00

Database selected.

> create user dbuser1 with password 'GBase8s123';

User created.

> create database db_yewu1 in datadbs1 with log;

Database closed.

Database created.

> database db_yewu1;

Database closed.

Database selected.

> grant dba to dbuser1;

Permission granted.

> connect to 'db_yewu1@gbase01' user 'dbuser1';
  ENTER PASSWORD:

Disconnected.

Connected.

-----------

使用了三级权限来保证数据的安全性,分别是数据库级,表级和字段级.
connect,resource,dba        数据库级权限
insert delete,select,update,references,index,alter,all        表级与字段级权限

connect   : 连接数据库,可以执行select, update, insert , delete语句,针对数据表执行存储过程,创建数据表的视图,创建临时表.
resource  :除了有connect全部权限外,还可以创建新表,并对自己的表执行alter和drop操作,创建索引.
dba          :对其他用户授予或解除connect,resource,dba权限,可以对所有数据库对象进行操作.

GBase 8s回收public权限（具有库级connect权限的用户自动获取public权限）
默认的情况下，数据库中public具有insert,delete,update,select,index权限。若只允许public用户只有select权限，则需要回收权限。
-- （单表）回收all权限，仅授予select权限给public
drop procedure if exists revoke_public_table(varchar);
create procedure revoke_public_table(p_tab varchar(128))
 if p_tab is not null AND p_tab <> '' then
   execute immediate "revoke all on "||p_tab||" from public";
--    execute immediate "grant select on "||p_tab||" to public";
 end if;
end procedure;

-- （所有表）循环处理所有表，执行revoke_public_table (注意tabid值, 以前版本99,新版本999)
drop procedure if exists revoke_public();
create procedure revoke_public()
 define p_tab varchar(128);
 FOREACH select tabname into p_tab from systables where tabid > 999 and tabtype = 'T'
   EXECUTE PROCEDURE revoke_public_table(p_tab);
 END FOREACH;
end procedure;

> call revoke_public();

Routine executed.