Oracle的监听口令及监听器安全

作者：eygle |English 【转载时请标明出处和作者信息】|【恩墨学院 OCM培训传DBA成功之道】

链接：http://www.eygle.com/archives/2007/11/listener_security.html

Oracle的监听器一直以来都存在一个严重的安全问题，那就是：

如果不设置安全措施，那么能够访问的用户就可以远程关闭监听器。

类似如下操作：

    D:\>lsnrctl stop eygle

    LSNRCTL for -bit Windows: Version 10.2.0.3. - Production on -11月- ::

    Copyright (c) , , Oracle.  All rights reserved.

    正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=))

    (CONNECT_DATA=(SERVICE_NAME=eygle)))

    命令执行成功

而此时缺省的监听器的日志还无法记录操作地址：

    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=)))

    -NOV- :: * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=Administrator))(COMMAND=stop)

    (ARGUMENTS=)(SERVICE=eygle)(VERSION=)) * stop * 

这个问题由来已久，为了保证监听器的安全，最好为监听设置密码：

    [oracle@jumper log]$ lsnrctl     

    LSNRCTL for Linux: Version 9.2.0.4. - Production on -NOV- ::

    Copyright (c) , , Oracle Corporation.  All rights reserved.

    Welcome to LSNRCTL, type "help" for information.

    LSNRCTL> set current_listener listener

    Current Listener is listener

    LSNRCTL> change_password

    Old password:

    New password:

    Reenter new password:

    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=)))

    Password changed for listener

    The command completed successfully

    LSNRCTL> set password

    Password:

    The command completed successfully

    LSNRCTL> save_config

    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=)))

    Saved LISTENER configuration parameters.

    Listener Parameter File  /opt/oracle/product/9.2./network/admin/listener.ora

    Old Parameter File  /opt/oracle/product/9.2./network/admin/listener.bak

    The command completed successfully

设置密码之后，远程操作将会因确实密码而失败：

    D:\>lsnrctl stop eygle

    LSNRCTL for -bit Windows: Version 10.2.0.3. - Production on -11月- ::

    Copyright (c) , , Oracle.  All rights reserved.

    正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)

    (PORT=))(CONNECT_DATA=(SERVICE_NAME=eygle)))

    TNS-: 监听程序尚未识别口令

此时在服务器端或客户端，都需要通过密码来起停监听器：

    LSNRCTL> set password

    Password:

    The command completed successfully

    LSNRCTL> stop

    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=)))

    The command completed successfully

    LSNRCTL> start

    Starting /opt/oracle/product/9.2./bin/tnslsnr: please wait...

    TNSLSNR for Linux: Version 9.2.0.4. - Production

    System parameter file is /opt/oracle/product/9.2./network/admin/listener.ora

    Log messages written to /opt/oracle/product/9.2./network/log/listener.log

    Trace information written to /opt/oracle/product/9.2./network/trace/listener.trc

    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=)))

    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=)))

    STATUS of the LISTENER

    ------------------------

    Alias                    LISTENER

    Version                  TNSLSNR for Linux: Version 9.2.0.4. - Production

    Start Date                -NOV- ::

    Uptime                     days  hr.  min.  sec

    Trace Level              support

    Security                  ON

    SNMP                      OFF

    Listener Parameter File  /opt/oracle/product/9.2./network/admin/listener.ora

    Listener Log File        /opt/oracle/product/9.2./network/log/listener.log

    Listener Trace File      /opt/oracle/product/9.2./network/trace/listener.trc

    Listening Endpoints Summary...

      (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=)))

    Services Summary...

    Service "eygle" has  instance(s).

      Instance "eygle", status UNKNOWN, has  handler(s) for this service...

    Service "julia" has  instance(s).

      Instance "eygle", status UNKNOWN, has  handler(s) for this service...

    The command completed successfully

此外，ADMIN_RESTRICTIONS参数也是一个重要的安全选项，我们可以在 listener.ora 文件中设置 ADMIN_RESTRICTIONS_<listener name> 为 ON，此后所有在运行时对监听器的修改都将被阻止，所有对监听器的修改都必须通过手工修改 listener.ora 文件来完成。

关于监听器安全参考文档：

Integrigy_Oracle_Listener_TNS_Security.pdf

-The End-