加固Oracle安全，为监听设置口令

最新推荐文章于 2025-05-12 22:11:53 发布

cndoc40428

最新推荐文章于 2025-05-12 22:11:53 发布

阅读量115

点赞数

文章标签：数据库网络操作系统

近日安全部门在对系统进行安全扫描检查时，报出有几套库的监听LISTENER的口令没有设置的警告信息，大部分系统的监听口令都是被设置的，仅有少量的几套9I和10G的监听没有配置口令，既然要做这项工作，就先做个测试，也与大家分享下。

在10G版本上的测试：

[oracle@ligle-db admin]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 12-APR-2011 12:49:20
Copyright (c) 1991, 2007, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener LIGLEWANG_LSNR      - - >设置为当前监听
Current Listener is LIGLEWANG_LSNR
LSNRCTL> change_password                - - >改变密码
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
Password changed for LIGLEWANG_LSNR
The command completed successfully
LSNRCTL> save_config                    - - >保存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
Saved LIGLEWANG_LSNR configuration parameters.
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
LSNRCTL> status                      - - >查询监听状态
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
STATUS of the LISTENER
------------------------
Alias                     LIGLEWANG_LSNR
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 – Production
Start Date                12-APR-2011 12:46:46
Uptime                    0 days 0 hr. 3 min. 44 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File
u01/app/oracle/product/10.2.0/db_1/network/log/liglewang_lsnr.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ligle-db)(PORT=8000)))
The listener supports no services
The command completed successfully

在status命令的输出中，可以看到有这样一行：

Security ON: Password or Local OS Authentication

该行表示使用本地操作系统认证，这种认证方式在我们对监听进行维护时是不需要输入口令的，这也是跟9i的一个小差别。当然也不是任何登录到OS中的用户都可以对LISTENER进行维护的，比如系统中存在ligle这样的一个用户：

[ligle@ligle-db ~]$ id                      - - >当前OS用户为ligle
uid=503(ligle) gid=501(oinstall) groups=501(oinstall),502(dba)
[ligle@ligle-db ~]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 12-APR-2011 13:16:17
Copyright (c) 1991, 2007, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener LIGLEWANG_LSNR      - - >设置为当前监听
Current Listener is LIGLEWANG_LSNR
LSNRCTL> status                      - - >查看监听状态（此操作没问题）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
STATUS of the LISTENER
------------------------
Alias                     LIGLEWANG_LSNR
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 – Production
Start Date                12-APR-2011 12:46:46
Uptime                    0 days 0 hr. 29 min. 44 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File
u01/app/oracle/product/10.2.0/db_1/network/log/liglewang_lsnr.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ligle-db)(PORT=8000)))
The listener supports no services
The command completed successfully
LSNRCTL> stop                               - - >停止监听（报错）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
TNS-01190: The user is not authorized to execute the requested listener command
LSNRCTL> set password                       - - >输入密码
Password:
The command completed successfully
LSNRCTL> stop                               - - >停止监听（正常）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
The command completed successfully