Oracle相关组件安全防范做的可谓真够全面，当然监听程序也有相关的安全设置；默认状态下，用户不需要使用任何密码即通过lsnrctl 工具对Oracle Listener进行操作或关闭，可造成新的会话无法建立连接；Oracle监听器允许利用lsnrctl从远程发起对监听器的管理，也容易导致数据库受到损坏。另外，ORACLE数据库监听器的管理9i与10g和11g还有点区别，9i数据库通过lsnrctl设置密码就会过滤系统认证，而10g和11g监听lsnrctl设置密码后不会自动生效，需要取消操作系统认证方能使监听密码设置生效。
这里特别提示11G监听密码设置
1、在ORACLE用户下，shell里输入lsnrctl回车可进入监听程序管理控制台
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:33:57
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL>
2、在监听管理控制台输入help可以查看监听管理命令
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start stop status
services version reload
save_config trace spawn
change_password quit exit
set* show*
3、监听未设置密码时oracle会话可使用lsnrctl启停监听程序（这也是监听程序的风险），启停监听
[oracle@orcl11g admin]$ lsnrctl stop
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:38:13
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
[oracle@orcl11g admin]$
[oracle@orcl11g admin]$ lsnrctl start
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:50
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 15:39:50
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Password or Local OS Authentication
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:54
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 15:39:50
Uptime 0 days 0 hr. 0 min. 3 sec
Trace Level off
Security ON: Password or Local OS Authentication
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$
4、这里使用lsnrctl管理工具为Oracle数据库监听设置密码
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:41:35
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start stop status
services version reload
save_config trace spawn
change_password quit exit
set* show*
LSNRCTL> change_password
Old password:<如果监听设置过密码则输入旧密码>
New password: <输入新密码>
Reenter new password: <输入新密码确认>
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password #设置控制台密码
Password:
The command completed successfully
LSNRCTL> save_config #保存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Old Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.bak
The command completed successfully
LSNRCTL>
5、测试密码安全设置是否生效（注意：需要reload或重启监听）
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
6、验证监听密码设置是否生效（注意：9i版本的是生效的，这里强调的是10g或11g使用了操作系统认证，监听的密码设置不自动生效）
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
可见，虽然监听设置了密码保护，但是由于11g使用了操作系统认证，监听的密码保护策略没有生效
7、在监听listener.ora配置文件中取消操作系统认证
SID_LIST_ORCL11G=
(SID_LIST=
(SID_DESC=
(GLOBAL_DBNAME=ORCL11G)
(SID_NAME=ORCL11G)
(ORACLE_HOME=/oracle/app/oracle/product/11.2.0.3/db)
(PRESPAWN_MAX=20)
(PRESPAWN_LIST=
(PRESPAWN_DESC=(PROTOCOL=tcp)(POOL_SIZE=2)(TIMEOUT=1))
)
)
)
LOCAL_OS_AUTHENTICATION_listener=OFF
#----ADDED BY TNSLSNR 08-JUL-2015 14:00:26---
PASSWORDS_LISTENER = FC996BE8FB638140
#--------------（这里就是监听设置了密码的标识了）------------------------------
8、在listener.ora配置取消操作系统认证后重启监听，重新验证监听密码是否生效
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:10:18
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
TNS-01169: The listener has not recognized the password
[oracle@orcl11g admin]$
可见，密码保护已经生效了
9、数据库监听设置了密码保护后，再管理数据库监听就需要通过lsnrctl 管理控制台使用set命令先设置密码了
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:12:18
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 16:08:52
Uptime 0 days 0 hr. 4 min. 21 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Services Summary...
Service "orcl11g" has 1 instance(s).
Instance "orcl11g", status READY, has 1 handler(s) for this service...
Service "orcl11gXDB" has 1 instance(s).
Instance "orcl11g", status READY, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> start
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 16:13:25
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
LSNRCTL>
10、重要提示，一旦设置了密码后，需要牢记密码，否则以后管理数据库监听会比较麻烦。
这里特别提示11G监听密码设置
1、在ORACLE用户下，shell里输入lsnrctl回车可进入监听程序管理控制台
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:33:57
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL>
2、在监听管理控制台输入help可以查看监听管理命令
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start stop status
services version reload
save_config trace spawn
change_password quit exit
set* show*
3、监听未设置密码时oracle会话可使用lsnrctl启停监听程序（这也是监听程序的风险），启停监听
[oracle@orcl11g admin]$ lsnrctl stop
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:38:13
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
[oracle@orcl11g admin]$
[oracle@orcl11g admin]$ lsnrctl start
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:50
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 15:39:50
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Password or Local OS Authentication
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:54
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 15:39:50
Uptime 0 days 0 hr. 0 min. 3 sec
Trace Level off
Security ON: Password or Local OS Authentication
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$
4、这里使用lsnrctl管理工具为Oracle数据库监听设置密码
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:41:35
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start stop status
services version reload
save_config trace spawn
change_password quit exit
set* show*
LSNRCTL> change_password
Old password:<如果监听设置过密码则输入旧密码>
New password: <输入新密码>
Reenter new password: <输入新密码确认>
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password #设置控制台密码
Password:
The command completed successfully
LSNRCTL> save_config #保存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Old Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.bak
The command completed successfully
LSNRCTL>
5、测试密码安全设置是否生效（注意：需要reload或重启监听）
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
6、验证监听密码设置是否生效（注意：9i版本的是生效的，这里强调的是10g或11g使用了操作系统认证，监听的密码设置不自动生效）
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
可见，虽然监听设置了密码保护，但是由于11g使用了操作系统认证，监听的密码保护策略没有生效
7、在监听listener.ora配置文件中取消操作系统认证
SID_LIST_ORCL11G=
(SID_LIST=
(SID_DESC=
(GLOBAL_DBNAME=ORCL11G)
(SID_NAME=ORCL11G)
(ORACLE_HOME=/oracle/app/oracle/product/11.2.0.3/db)
(PRESPAWN_MAX=20)
(PRESPAWN_LIST=
(PRESPAWN_DESC=(PROTOCOL=tcp)(POOL_SIZE=2)(TIMEOUT=1))
)
)
)
LOCAL_OS_AUTHENTICATION_listener=OFF
#----ADDED BY TNSLSNR 08-JUL-2015 14:00:26---
PASSWORDS_LISTENER = FC996BE8FB638140
#--------------（这里就是监听设置了密码的标识了）------------------------------
8、在listener.ora配置取消操作系统认证后重启监听，重新验证监听密码是否生效
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:10:18
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
TNS-01169: The listener has not recognized the password
[oracle@orcl11g admin]$
可见，密码保护已经生效了
9、数据库监听设置了密码保护后，再管理数据库监听就需要通过lsnrctl 管理控制台使用set命令先设置密码了
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:12:18
Copyright (c) 1991, 2011, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 16:08:52
Uptime 0 days 0 hr. 4 min. 21 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Services Summary...
Service "orcl11g" has 1 instance(s).
Instance "orcl11g", status READY, has 1 handler(s) for this service...
Service "orcl11gXDB" has 1 instance(s).
Instance "orcl11g", status READY, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> start
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date 08-JUL-2015 16:13:25
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
LSNRCTL>
10、重要提示，一旦设置了密码后，需要牢记密码，否则以后管理数据库监听会比较麻烦。
