監(jiān)聽器也有安全？Sure！在缺省的情況下，任意用戶不需要使用任何密碼即通過lsnrctl 工具對Oracle Listener進行操作或關閉，從而造成任意新的會話都將無法建立連接。在Oracle 9i 中Oracle監(jiān)聽器允許任何一個人利用lsnrctl從遠程發(fā)起對監(jiān)聽器的管理。也容易導致數(shù)據(jù)庫受到損壞。
1. 未設定密碼情形下停止監(jiān)聽
[oracle@test ~]$ lsnrctl stop listener_demo92 -->停止監(jiān)聽，可以看出不需要任何密碼即可停止 LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:22:26 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) The command completed successfully
2. 重新啟動監(jiān)聽并設置密碼
[oracle@test ~]$ lsnrctl LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:24:09 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Welcome to LSNRCTL, type "help" for information. LSNRCTL> set current_listener listener_demo92 -->設置當前監(jiān)聽器 Current Listener is listener_demo92 LSNRCTL> start -->啟動過程也不需要任何密碼,啟動的詳細信息省略 LSNRCTL> change_password -->使用change_password來設置密碼 Old password: New password: Reenter new password: Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) Password changed for listener_demo92 The command completed successfully LSNRCTL> save_config -->注意此處的save_config失敗 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password LSNRCTL> set password -->輸入新設定的密碼驗證 Password: The command completed successfully LSNRCTL> save_config -->再次save_config成功 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) Saved listener_demo92 configuration parameters. Listener Parameter File /oracle/92/network/admin/listener.ora Old Parameter File /oracle/92/network/admin/listener.bak The command completed successfully -->增加密碼之后可以看到listener.ora文件中有一條新增的記錄，即密碼選項(注：盡管使用了密碼管理方式,仍然可以無需密碼啟動監(jiān)聽)[oracle@test admin]$ more listener.ora #----ADDED BY TNSLSNR 26-JUN-2011 05:12:48--- PASSWORDS_listener_demo92 = #--------------------------------------------
3. 嘗試未使用密碼的情況下停止監(jiān)聽
[oracle@test ~]$ lsnrctl stop listener_demo92 LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 06:09:51 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password -->收到錯誤信息，需要使用密碼認證
4. 使用密碼來停止監(jiān)聽
[oracle@test ~]$ lsnrctl LSNRCTL> set current_listener listener_demo92 Current Listener is listener_demo92 LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password LSNRCTL> set password Password: The command completed successfully LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) The command completed successfully LSNRCTL> status Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 111: Connection refused Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 2: No such file or directory
5. save_config失敗的問題
-->在 Oracle 9i中，使用save_config命令將會失敗 LSNRCTL> save_config Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<hostname>)(PORT=<port>))) TNS-01169: The listener has not recognized the password -->應該先使用set password之后再save_config，則保存配置成功。 LSNRCTL> set password Password: <the password you chose> The command completed successfully /*在Oracle 10g 中不會出現(xiàn)類似的問題，因為在10g中可以使用基于操作系統(tǒng)驗證方式。listener將檢測到如果用戶屬于dba組的成員，將會被授予改變密碼，保存配置以及停止監(jiān)聽等權限。 */
6. 配置listener.ora中ADMIN_RESTRICTIONS參數(shù)
參數(shù)作用：
當在listener.ora文件中設置了ADMIN_RESTRICTIONS參數(shù)后，在監(jiān)聽器運行時，不允許執(zhí)行任何管理命令，同時set命令將不可用
，不論是在服務器本地還是從遠程執(zhí)行都不行。此時對于監(jiān)聽的設置僅僅通過手工修改listener.ora文件，要使修改生效，只能
使用lsnrctl reload命令或lsnrctl stop/start命令重新載入一次監(jiān)聽器配置信息。
修改方法：
在listener.ora文件中手動加入下面這樣一行
ADMIN_RESTRICTIONS_<監(jiān)聽器名> = ON
下面是其它網(wǎng)友的補充：
LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
[oracle@ecp-uc-db1 admin]$ cat listener.ora
#―-ADDED BY TNSLSNR 10-JUN-2011 18:13:24―
PASSWORDS_LISTENER = 6D7AA003392C436A
#――――――――――――――
主站蜘蛛池模板：
依安县|
天全县|
黄梅县|
永清县|
福贡县|
富锦市|
泰宁县|
大埔区|
盘山县|
柳河县|
海安县|
宜良县|
盐源县|
孟州市|
内江市|
阳泉市|
荔波县|
仙游县|
绥德县|
青神县|
安溪县|
武隆县|
青冈县|
许昌县|
合作市|
广丰县|
万州区|
江口县|
康乐县|
荣昌县|
闽侯县|
襄城县|
阜阳市|
汾西县|
英吉沙县|
富宁县|
宁夏|
同江市|
临高县|
育儿|
昌邑市|