When working with Oracle DataPump remotely, you'll encounter authentication limitations when trying to use SYSDBA privileges. Unlike local connections where / as sysdba works seamlessly, remote connections require specific configuration.

Here are the verified methods to execute DataPump commands with SYSDBA privileges from a remote machine:

Method 1: Using Password File Authentication

expdp \'sys@SID as sysdba\' DIRECTORY=data_pump_dir DUMPFILE=export.dmp LOGFILE=export.log

Prerequisites:
- Remote login must be enabled in sqlnet.ora: SQLNET.AUTHENTICATION_SERVICES=(NTS)
- Password file must exist: orapwd file=orapwSID entries=10 force=y
- User must have SYSDBA privilege granted

Method 2: Using TNS Connect String

expdp \'sys/password@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbhost)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=SID)(SERVER=DEDICATED))) as sysdba\' 
schemas=HR DIRECTORY=data_pump_dir DUMPFILE=hr_schema.dmp

Method 3: Using Wallet Authentication (Most Secure)

Create a wallet and configure it:

mkstore -wrl /path/to/wallet -create
mkstore -wrl /path/to/wallet -createCredential db_alias sys password

Then use:

expdp \'/@db_alias as sysdba\' schemas=SCOTT dumpfile=scott.dmp directory=dpump_dir

LRM-00108: Typically occurs when the connection string format is incorrect. Always use single quotes around the entire credential string and escape them properly.

ORA-01017: Invalid username/password. Verify your password file exists and the remote_login_passwordfile parameter is set to EXCLUSIVE or SHARED.

When running DataPump remotely:

• Use NETWORK_LINK parameter if possible to avoid data transfer over network
• Set PARALLEL parameter appropriately for large exports
• Consider COMPRESSION=ALL to reduce network traffic

• Never store passwords in scripts - use wallet authentication
• Restrict access to the directory object used for dump files
• Use SSL/TLS for remote connections
• Set expiration for password file entries

---

When working with Oracle databases, there are times when you need to execute DataPump operations (expdp/impdp) with SYSDBA privileges from a remote machine. The standard syntax that works locally doesn't translate directly to remote connections.

The common attempts like:

expdp 'SYS@SID AS SYSDBA'
expdp \"SYS AS SYSDBA\"@SID

Result in the frustrating LRM-00108 error because Oracle DataPump doesn't directly support the AS SYSDBA syntax in the connection string when invoked from the command line.

Here are two reliable methods to accomplish remote SYSDBA access:

Method 1: Using a TNS Alias with Remote Login

First, create a dedicated TNS entry in your tnsnames.ora:

REMOTE_SYSDBA =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = dbserver)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ORCL)
      (UR=A)
    )
  )

Then use it with:

expdp \"/@REMOTE_SYSDBA AS SYSDBA\" dumpfile=export.dmp logfile=export.log

Method 2: Using a Wallet with SYSDBA Credentials

For more secure automated operations:

mkstore -wrl $ORACLE_HOME/wallet -create
mkstore -wrl $ORACLE_HOME/wallet -createCredential REMOTE_SYSDBA SYS \"your_password\"

Then reference it in your sqlnet.ora:

SQLNET.WALLET_OVERRIDE = TRUE
WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = /path/to/wallet)
    )
  )

When enabling remote SYSDBA access:

• Always use encrypted network connections (TLS/SSL)
• Consider IP restrictions at the firewall level
• Use strong, complex passwords for SYS accounts
• Regularly audit SYSDBA access logs

If you encounter ORA-01031: insufficient privileges:

1. Verify the remote_login_passwordfile parameter is set to EXCLUSIVE or SHARED
2. Ensure the password file exists and contains the SYS password
3. Check that the connecting user is in the dba group on the server