绿盟扫描提示引用程序脆弱账号 Oracle tnslsnr 监听器,加密主要为了防止监听被恶意远程关闭。关于这个安全问题的详细说明参见文字结尾转载的说明《Oracle的监听口令及监听器安全》
主要用到以下几个命令:
1)lsnrctl 进入监听模式;
2)set password设置密码;
3)change_password 修改密码;
4)save_config 保存配置;
5)exit 退出监听;
#1:命令行输入: lsnrctl 回车
C:Documents and SettingsAdministrator>lsnrctl
LSNRCTL for 32-bit Windows: Version 9.2.0.1.0 - Production on 21-1月 -2018 09:33:30
欢迎来到LSNRCTL,请键入"help"以获得信息。
#2:输入 change_password 回车
LSNRCTL> change_password
Old password: # 输入原密码,空直接回车
New password: # 输入新密码
Reenter new password: # 重复输入新密码
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx-94b9880xr5)(PORT=1521)))
LISTENER的口令已更改
命令执行成功
#3:保存配置
LSNRCTL> set password # 因为更改过密码,需要先设置新密码
Password:
命令执行成功
LSNRCTL> save_config
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx-94b9880xr5)(PORT=1521)))
保存的LISTENER配置参数。
监听器参数文件 E:oracleora92
etworkadminlistener.ora
旧的参数文件E:oracleora92
etworkadminlistener.bak
命令执行成功
LSNRCTL> save_config # 如果没有设置密码保存,就会提示错误
正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rdlg-94b9880xr5)(PORT=1521)))))
TNS-01169: 监听器尚未识别口令
#4:退出
LSNRCTL> exit
#5:验证
打开文件 E:oracleora92
etworkadminlistener.ora
新增一下内容
#----ADDED BY TNSLSNR 21-1月 -2018 09:34:41---
PASSWORDS_LISTENER = 6336EEA3D5E41DD9
#---------------------------------------------
Oracle的监听口令及监听器安全 作者:eygle |English 【转载时请标明出处和作者信息】|【恩墨学院 OCM培训传DBA成功之道】 链接:http://www.eygle.com/archives/2007/11/listener_security.html Oracle的监听器一直以来都存在一个严重的安全问题,那就是: 如果不设置安全措施,那么能够访问的用户就可以远程关闭监听器。 类似如下操作: D:>lsnrctl stop eygle LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 28-11月-2007 10:02:40 Copyright (c) 1991, 2006, Oracle. All rights reserved. 正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521)) (CONNECT_DATA=(SERVICE_NAME=eygle))) 命令执行成功 而此时缺省的监听器的日志还无法记录操作地址: No longer listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521))) 28-NOV-2007 09:59:20 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=Administrator))(COMMAND=stop) (ARGUMENTS=64)(SERVICE=eygle)(VERSION=169870080)) * stop * 0 这个问题由来已久,为了保证监听器的安全,最好为监听设置密码: [oracle@jumper log]$ lsnrctl LSNRCTL for Linux: Version 9.2.0.4.0 - Production on 28-NOV-2007 10:18:17 Copyright (c) 1991, 2002, Oracle Corporation. All rights reserved. Welcome to LSNRCTL, type "help" for information. LSNRCTL> set current_listener listener Current Listener is listener LSNRCTL> change_password Old password: New password: Reenter new password: Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521))) Password changed for listener The command completed successfully LSNRCTL> set password Password: The command completed successfully LSNRCTL> save_config Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521))) Saved LISTENER configuration parameters. Listener Parameter File /opt/oracle/product/9.2.0/network/admin/listener.ora Old Parameter File /opt/oracle/product/9.2.0/network/admin/listener.bak The command completed successfully 设置密码之后,远程操作将会因确实密码而失败: D:>lsnrctl stop eygle LSNRCTL for 32-bit Windows: Version 10.2.0.3.0 - Production on 28-11月-2007 10:22:57 Copyright (c) 1991, 2006, Oracle. All rights reserved. 正在连接到 (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11) (PORT=1521))(CONNECT_DATA=(SERVICE_NAME=eygle))) TNS-01169: 监听程序尚未识别口令 此时在服务器端或客户端,都需要通过密码来起停监听器: LSNRCTL> set password Password: The command completed successfully LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521))) The command completed successfully LSNRCTL> start Starting /opt/oracle/product/9.2.0/bin/tnslsnr: please wait... TNSLSNR for Linux: Version 9.2.0.4.0 - Production System parameter file is /opt/oracle/product/9.2.0/network/admin/listener.ora Log messages written to /opt/oracle/product/9.2.0/network/log/listener.log Trace information written to /opt/oracle/product/9.2.0/network/trace/listener.trc Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521))) Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.33.11)(PORT=1521))) STATUS of the LISTENER ------------------------ Alias LISTENER Version TNSLSNR for Linux: Version 9.2.0.4.0 - Production Start Date 28-NOV-2007 10:22:23 Uptime 0 days 0 hr. 0 min. 0 sec Trace Level support Security ON SNMP OFF Listener Parameter File /opt/oracle/product/9.2.0/network/admin/listener.ora Listener Log File /opt/oracle/product/9.2.0/network/log/listener.log Listener Trace File /opt/oracle/product/9.2.0/network/trace/listener.trc Listening Endpoints Summary... (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=172.16.33.11)(PORT=1521))) Services Summary... Service "eygle" has 1 instance(s). Instance "eygle", status UNKNOWN, has 1 handler(s) for this service... Service "julia" has 1 instance(s). Instance "eygle", status UNKNOWN, has 1 handler(s) for this service... The command completed successfully 此外,ADMIN_RESTRICTIONS参数也是一个重要的安全选项,我们可以在 listener.ora 文件中设置 ADMIN_RESTRICTIONS_<listener name> 为 ON,此后所有在运行时对监听器的修改都将被阻止,所有对监听器的修改都必须通过手工修改 listener.ora 文件来完成。 关于监听器安全参考文档: Integrigy_Oracle_Listener_TNS_Security.pdf -The End-