欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  IT编程

Oracle 监听器密码设置方法(LISTENER)

程序员文章站 2023-02-22 13:14:42
监听器也有安全?sure!在缺省的情况下,任意用户不需要使用任何密码即通过lsnrctl 工具对oracle listener进行操作或关闭,从而造成任意新的会话都将无法建...

监听器也有安全?sure!在缺省的情况下,任意用户不需要使用任何密码即通过lsnrctl 工具对oracle listener进行操作或关闭,从而造成任意新的会话都将无法建立连接。在oracle 9i 中oracle监听器允许任何一个人利用lsnrctl从远程发起对监听器的管理。也容易导致数据库受到损坏。

1. 未设定密码情形下停止监听

[oracle@test ~]$ lsnrctl stop listener_demo92  -->停止监听,可以看出不需要任何密码即可停止 
                                              
lsnrctl for linux: version 9.2.0.8.0 - production on 26-jun-2011 08:22:26          
                                              
copyright (c) 1991, 2006, oracle corporation. all rights reserved.             
                                              
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))         
the command completed successfully 

2. 重新启动监听并设置密码

[oracle@test ~]$ lsnrctl                                                 
                                                             
lsnrctl for linux: version 9.2.0.8.0 - production on 26-jun-2011 08:24:09                         
copyright (c) 1991, 2006, oracle corporation. all rights reserved.                            
                                                             
welcome to lsnrctl, type "help" for information.	                                    
lsnrctl> set current_listener listener_demo92 -->设置当前监听器                             
current listener is listener_demo92                                            
lsnrctl> start       -->启动过程也不需要任何密码,启动的详细信息省略                         
lsnrctl> change_password  -->使用change_password来设置密码                                
old password:                                                       
new password:                                                       
reenter new password:                                                   
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))                        
password changed for listener_demo92                                           
the command completed successfully                                            
lsnrctl> save_config    -->注意此处的save_config失败                                 
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))                        
tns-01169: the listener has not recognized the password                                  
lsnrctl> set password    -->输入新设定的密码验证                                    
password:                                                         
the command completed successfully                                            
lsnrctl> save_config    -->再次save_config成功                                     
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))                        
saved listener_demo92 configuration parameters.                                      
listener parameter file  /oracle/92/network/admin/listener.ora                              
old parameter file  /oracle/92/network/admin/listener.bak                                
the command completed successfully                                            
                                                             
-->增加密码之后可以看到listener.ora文件中有一条新增的记录,即密码选项(注:尽管使用了密码管理方式,仍然可以无需密码启动监听)
[oracle@test admin]$ more listener.ora                                          
	#----added by tnslsnr 26-jun-2011 05:12:48---                                      
	passwords_listener_demo92 =                                               
	#--------------------------------------------

3. 尝试未使用密码的情况下停止监听

[oracle@test ~]$ lsnrctl stop listener_demo92                        
lsnrctl for linux: version 9.2.0.8.0 - production on 26-jun-2011 06:09:51          
copyright (c) 1991, 2006, oracle corporation. all rights reserved.             
                                              
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))         
tns-01169: the listener has not recognized the password  -->收到错误信息,需要使用密码认证

4. 使用密码来停止监听

[oracle@test ~]$ lsnrctl                            
lsnrctl> set current_listener listener_demo92                 
current listener is listener_demo92                      
lsnrctl> stop                                 
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))   
tns-01169: the listener has not recognized the password            
lsnrctl> set password                             
password:                                   
the command completed successfully                       
lsnrctl> stop                                 
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))   
the command completed successfully                       
lsnrctl> status                                
connecting to (description=(address=(protocol=tcp)(host=test)(port=1521)))   
tns-12541: tns:no listener                           
 tns-12560: tns:protocol adapter error                     
 tns-00511: no listener                            
  linux error: 111: connection refused                    
connecting to (description=(address=(protocol=ipc)(key=extproc)))       
tns-12541: tns:no listener                           
 tns-12560: tns:protocol adapter error                     
 tns-00511: no listener                            
  linux error: 2: no such file or directory	                 

5. save_config失败的问题

-->在 oracle 9i中,使用save_config命令将会失败                                     
	lsnrctl> save_config                                                 
	connecting to (description=(address=(protocol=tcp)(host=<hostname>)(port=<port>)))                  
	tns-01169: the listener has not recognized the password	                               
                                                            
-->应该先使用set password之后再save_config,则保存配置成功。                              
	lsnrctl> set password                                                
	password: <the password you chose>                                          
	the command completed successfully                          
/*在oracle 10g 中不会出现类似的问题,因为在10g中可以使用基于操作系统验证方式。listener将检测到如果用户属于dba组的成员,
将会被授予改变密码,保存配置以及停止监听等权限。 */                                 

6. 配置listener.ora中admin_restrictions参数

参数作用:
当在listener.ora文件中设置了admin_restrictions参数后,在监听器运行时,不允许执行任何管理命令,同时set命令将不可用
,不论是在服务器本地还是从远程执行都不行。此时对于监听的设置仅仅通过手工修改listener.ora文件,要使修改生效,只能
使用lsnrctl reload命令或lsnrctl stop/start命令重新载入一次监听器配置信息。
修改方法:
在listener.ora文件中手动加入下面这样一行
admin_restrictions_<监听器名> = on

下面是其它网友的补充:

lsnrctl> change_password
old password:
new password:
reenter new password:
connecting to (description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
password changed for listener
the command completed successfully
lsnrctl> set password
password:
the command completed successfully
lsnrctl> save_config
connecting to (description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
saved listener configuration parameters.
listener parameter file /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
old parameter file /opt/oracle/product/10.2.0/db_1/network/admin/listener.bak
the command completed successfully
[oracle@ecp-uc-db1 admin]$ cat listener.ora
#—-added by tnslsnr 10-jun-2011 18:13:24—
passwords_listener = 6d7aa003392c436a
#——————————————–
note:10g数据库上需要上添加(重启监听)
local_os_authentication_listener = off

1、添加local_os_authentication_listener = off之前

security on: password or local os authentication

2、添加local_os_authentication_listener = off之后

security on: password
lsnrctl> status
connecting to (description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
tns-01169: the listener has not recognized the password
lsnrctl> stop
connecting to (description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
tns-01169: the listener has not recognized the password
lsnrctl> set password 123456
the command completed successfully
lsnrctl> status
connecting to (description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
status of the listener
————————
alias listener
version tnslsnr for linux: version 10.2.0.4.0 – production
start date 10-jun-2011 18:15:49
uptime 0 days 0 hr. 1 min. 16 sec
trace level off
security on: password
snmp off
listener parameter file /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
listener log file /opt/oracle/product/10.2.0/db_1/network/log/listener.log
listening endpoints summary…
(description=(address=(protocol=tcp)(host=ecp-uc-db1)(port=1521)))
(description=(address=(protocol=ipc)(key=extproc0)))
services summary…
service “plsextproc” has 1 instance(s).
instance “plsextproc”, status unknown, has 1 handler(s) for this service…
service “ecp” has 1 instance(s).
instance “ecp”, status ready, has 1 handler(s) for this service…
service “ecpxdb” has 1 instance(s).
instance “ecp”, status ready, has 1 handler(s) for this service…
service “ecp_xpt” has 1 instance(s).
instance “ecp”, status ready, has 1 handler(s) for this service…
the command completed successfully