設置Oracle tnslsnr監聽器口令

綠盟掃描提示引用程序脆弱賬號  Oracle tnslsnr 監聽器，加密主要為了防止監聽被惡意遠程關閉。關於這個安全問題的詳細說明參見文字結尾轉載的說明《Oracle的監聽口令及監聽器安全》

主要用到以下幾個命令：

1）lsnrctl 進入監聽模式；

2）set password設置密碼；

3）change_password 修改密碼；

4）save_config 保存配置；

5）exit 退出監聽；

 

#1：命令行輸入： lsnrctl 回車

C:\Documents and Settings\Administrator>lsnrctl

LSNRCTL for 32-bit Windows: Version 9.2.0.1.0 - Production on 21-1月 -2018 09:33:30

歡迎來到LSNRCTL，請鍵入"help"以獲得信息。

 

#2：輸入 change_password 回車

LSNRCTL> change_password

Old password: # 輸入原密碼，空直接回車

New password: # 輸入新密碼

Reenter new password: # 重復輸入新密碼

正在連接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx-94b9880xr5)(PORT=1521)))

LISTENER的口令已更改

命令執行成功

 

#3：保存配置

LSNRCTL> set password # 因為更改過密碼，需要先設置新密碼

Password:

命令執行成功

LSNRCTL> save_config

正在連接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx-94b9880xr5)(PORT=1521)))

保存的LISTENER配置參數。

監聽器參數文件 E:\oracle\ora92\network\admin\listener.ora

舊的參數文件E:\oracle\ora92\network\admin\listener.bak

命令執行成功

 

LSNRCTL> save_config # 如果沒有設置密碼保存，就會提示錯誤

正在連接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rdlg-94b9880xr5)(PORT=1521)))))

TNS-01169: 監聽器尚未識別口令

 

#4：退出

LSNRCTL> exit

 

#5：驗證

打開文件 E:\oracle\ora92\network\admin\listener.ora

新增一下內容

#----ADDED BY TNSLSNR 21-1月 -2018 09:34:41---

PASSWORDS_LISTENER = 6336EEA3D5E41DD9

#---------------------------------------------

 

Oracle的監聽口令及監聽器安全
作者：eygle |English 【轉載時請標明出處和作者信息】|【恩墨學院 OCM培訓傳DBA成功之道】
鏈接：http://www.eygle.com/archives/2007/11/listener_security.html
Oracle的監聽器一直以來都存在一個嚴重的安全問題，那就是：
如果不設置安全措施，那么能夠訪問的用戶就可以遠程關閉監聽器。

類似如下操作：

    D:\>lsnrctl stop eygle

    LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 28-11月-2007 10:02:40

    Copyright (c) 1991, 2006, Oracle.  All rights reserved.

    正在連接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521))
    (CONNECT_DATA=(SERVICE_NAME=eygle)))
    命令執行成功


而此時缺省的監聽器的日志還無法記錄操作地址：

    No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521)))
    28-NOV-2007 09:59:20 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=Administrator))(COMMAND=stop)
    (ARGUMENTS=64)(SERVICE=eygle)(VERSION=169870080)) * stop * 0


這個問題由來已久，為了保證監聽器的安全，最好為監聽設置密碼：

    [oracle@jumper log]$ lsnrctl     

    LSNRCTL for Linux: Version 9.2.0.4.0 - Production on 28-NOV-2007 10:18:17

    Copyright (c) 1991, 2002, Oracle Corporation.  All rights reserved.

    Welcome to LSNRCTL, type "help" for information.

    LSNRCTL> set current_listener listener
    Current Listener is listener
    LSNRCTL> change_password
    Old password:
    New password:
    Reenter new password:
    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521)))
    Password changed for listener
    The command completed successfully
    LSNRCTL> set password
    Password:
    The command completed successfully
    LSNRCTL> save_config
    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521)))
    Saved LISTENER configuration parameters.
    Listener Parameter File  /opt/oracle/product/9.2.0/network/admin/listener.ora
    Old Parameter File  /opt/oracle/product/9.2.0/network/admin/listener.bak
    The command completed successfully


設置密碼之后，遠程操作將會因確實密碼而失敗：

    D:\>lsnrctl stop eygle

    LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 28-11月-2007 10:22:57
    Copyright (c) 1991, 2006, Oracle.  All rights reserved.

    正在連接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)
    (PORT=1521))(CONNECT_DATA=(SERVICE_NAME=eygle)))
    TNS-01169: 監聽程序尚未識別口令


此時在服務器端或客戶端，都需要通過密碼來起停監聽器：

    LSNRCTL> set password
    Password:
    The command completed successfully
    LSNRCTL> stop
    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521)))
    The command completed successfully
    LSNRCTL> start
    Starting /opt/oracle/product/9.2.0/bin/tnslsnr: please wait...

    TNSLSNR for Linux: Version 9.2.0.4.0 - Production
    System parameter file is /opt/oracle/product/9.2.0/network/admin/listener.ora
    Log messages written to /opt/oracle/product/9.2.0/network/log/listener.log
    Trace information written to /opt/oracle/product/9.2.0/network/trace/listener.trc
    Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521)))

    Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521)))
    STATUS of the LISTENER
    ------------------------
    Alias                    LISTENER
    Version                  TNSLSNR for Linux: Version 9.2.0.4.0 - Production
    Start Date                28-NOV-2007 10:22:23
    Uptime                    0 days 0 hr. 0 min. 0 sec
    Trace Level              support
    Security                  ON
    SNMP                      OFF
    Listener Parameter File  /opt/oracle/product/9.2.0/network/admin/listener.ora
    Listener Log File        /opt/oracle/product/9.2.0/network/log/listener.log
    Listener Trace File      /opt/oracle/product/9.2.0/network/trace/listener.trc
    Listening Endpoints Summary...
      (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521)))
    Services Summary...
    Service "eygle" has 1 instance(s).
      Instance "eygle", status UNKNOWN, has 1 handler(s) for this service...
    Service "julia" has 1 instance(s).
      Instance "eygle", status UNKNOWN, has 1 handler(s) for this service...
    The command completed successfully


此外，ADMIN_RESTRICTIONS參數也是一個重要的安全選項，我們可以在 listener.ora 文件中設置 ADMIN_RESTRICTIONS_<listener name> 為 ON，此后所有在運行時對監聽器的修改都將被阻止，所有對監聽器的修改都必須通過手工修改 listener.ora 文件來完成。

關於監聽器安全參考文檔：
Integrigy_Oracle_Listener_TNS_Security.pdf

-The End-