ORACLE数据库安全漏洞之监听密码设置

简介:     Oracle相关组件安全防范做的可谓真够全面,当然监听程序也有相关的安全设置;默认状态下,用户不需要使用任何密码即通过lsnrctl 工具对Oracle Listener进行操作或关闭,可造成新的会话无法建立连接;Oracle监听器允许利用lsnrctl从远程发起对监听器的管理,也容易导致数据库受到损坏。
    Oracle相关组件安全防范做的可谓真够全面,当然监听程序也有相关的安全设置;默认状态下,用户不需要使用任何密码即通过lsnrctl 工具对Oracle Listener进行操作或关闭,可造成新的会话无法建立连接;Oracle监听器允许利用lsnrctl从远程发起对监听器的管理,也容易导致数据库受到损坏。另外,ORACLE数据库监听器的管理9i与10g和11g还有点区别,9i数据库通过lsnrctl设置密码就会过滤系统认证,而10g和11g监听lsnrctl设置密码后不会自动生效,需要取消操作系统认证方能使监听密码设置生效。
   这里特别提示11G监听密码设置
1、在ORACLE用户下,shell里输入lsnrctl回车可进入监听程序管理控制台
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:33:57
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> 

2、在监听管理控制台输入help可以查看监听管理命令
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start               stop                status              
services            version             reload              
save_config         trace               spawn               
change_password     quit                exit                
set*                show*  

3、监听未设置密码时oracle会话可使用lsnrctl启停监听程序(这也是监听程序的风险),启停监听
[oracle@orcl11g admin]$ lsnrctl stop
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:38:13
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
[oracle@orcl11g admin]$ 
[oracle@orcl11g admin]$ lsnrctl start
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:50
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 15:39:50
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:54
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 15:39:50
Uptime                    0 days 0 hr. 0 min. 3 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ 

4、这里使用lsnrctl管理工具为Oracle数据库监听设置密码
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:41:35
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start               stop                status              
services            version             reload              
save_config         trace               spawn               
change_password     quit                exit                
set*                show*               
LSNRCTL> change_password
Old password:<如果监听设置过密码则输入旧密码> 
New password: <输入新密码>
Reenter new password: <输入新密码确认>
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password #设置控制台密码
Password: 
The command completed successfully
LSNRCTL> save_config #保存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Old Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.bak
The command completed successfully
LSNRCTL> 

5、测试密码安全设置是否生效(注意:需要reload或重启监听)
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> 

6、验证监听密码设置是否生效(注意:9i版本的是生效的,这里强调的是10g或11g使用了操作系统认证,监听的密码设置不自动生效)
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
可见,虽然监听设置了密码保护,但是由于11g使用了操作系统认证,监听的密码保护策略没有生效

7、在监听listener.ora配置文件中取消操作系统认证
SID_LIST_ORCL11G=
   (SID_LIST=
(SID_DESC=
          (GLOBAL_DBNAME=ORCL11G)
          (SID_NAME=ORCL11G)
          (ORACLE_HOME=/oracle/app/oracle/product/11.2.0.3/db)
         (PRESPAWN_MAX=20)
 (PRESPAWN_LIST=
           (PRESPAWN_DESC=(PROTOCOL=tcp)(POOL_SIZE=2)(TIMEOUT=1))
         )
        )
       )

LOCAL_OS_AUTHENTICATION_listener=OFF

#----ADDED BY TNSLSNR 08-JUL-2015 14:00:26---
PASSWORDS_LISTENER = FC996BE8FB638140
#--------------(这里就是监听设置了密码的标识了)------------------------------

8、在listener.ora配置取消操作系统认证后重启监听,重新验证监听密码是否生效
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:10:18
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
TNS-01169: The listener has not recognized the password
[oracle@orcl11g admin]$
可见,密码保护已经生效了

9、数据库监听设置了密码保护后,再管理数据库监听就需要通过lsnrctl 管理控制台使用set命令先设置密码了
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:12:18
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password: 
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 16:08:52
Uptime                    0 days 0 hr. 4 min. 21 sec
Trace Level               off
Security                  ON: Password
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Services Summary...
Service "orcl11g" has 1 instance(s).
  Instance "orcl11g", status READY, has 1 handler(s) for this service...
Service "orcl11gXDB" has 1 instance(s).
  Instance "orcl11g", status READY, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> start
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 16:13:25
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  ON: Password
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
LSNRCTL> 

10、重要提示,一旦设置了密码后,需要牢记密码,否则以后管理数据库监听会比较麻烦。

目录
相关文章
|
1天前
|
存储 监控 Oracle
关系型数据库Oracle备份策略建议
【7月更文挑战第21天】
10 6
|
1天前
|
存储 Oracle 关系型数据库
|
2天前
|
监控 Oracle 关系型数据库
关系型数据库Oracle恢复测试
【7月更文挑战第20天】
18 7
|
1天前
|
Oracle 关系型数据库 Unix
关系型数据库Oracle设置环境变量:
【7月更文挑战第22天】
12 4
|
1天前
|
运维 Oracle 关系型数据库
关系型数据库Oracle自动化备份
【7月更文挑战第21天】
11 3
|
3天前
|
存储 SQL Oracle
关系型数据库Oracle归档日志备份
【7月更文挑战第19天】
18 5
|
3天前
|
SQL Oracle 关系型数据库
关系型数据库Oracle备份工具
【7月更文挑战第19天】
16 4
|
2天前
|
存储 Oracle 安全
关系型数据库Oracle备份频率
【7月更文挑战第20天】
10 2
|
2天前
|
存储 Oracle 关系型数据库
关系型数据库Oracle备份策略
【7月更文挑战第20天】
10 2
|
3天前
|
存储 Oracle 关系型数据库
关系型数据库Oracle差异备份
【7月更文挑战第19天】
15 3

推荐镜像

更多