Oracle 監(jiān)聽器密碼設(shè)置方法(LISTENER)
監(jiān)聽器也有安全？Sure！在缺省的情況下，任意用戶不需要使用任何密碼即通過(guò)lsnrctl 工具對(duì)Oracle Listener進(jìn)行操作或關(guān)閉，從而造成任意新的會(huì)話都將無(wú)法建立連接。在Oracle 9i 中Oracle監(jiān)聽器允許任何一個(gè)人利用lsnrctl從遠(yuǎn)程發(fā)起對(duì)監(jiān)聽器的管理。也容易導(dǎo)致數(shù)據(jù)庫(kù)受到損壞。
1. 未設(shè)定密碼情形下停止監(jiān)聽
[oracle@test ~]$ lsnrctl stop listener_demo92 -->停止監(jiān)聽，可以看出不需要任何密碼即可停止
LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:22:26
Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
The command completed successfully
2. 重新啟動(dòng)監(jiān)聽并設(shè)置密碼
[oracle@test ~]$ lsnrctl
LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:24:09
Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener listener_demo92 -->設(shè)置當(dāng)前監(jiān)聽器
Current Listener is listener_demo92
LSNRCTL> start -->啟動(dòng)過(guò)程也不需要任何密碼,啟動(dòng)的詳細(xì)信息省略
LSNRCTL> change_password -->使用change_password來(lái)設(shè)置密碼
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
Password changed for listener_demo92
The command completed successfully
LSNRCTL> save_config -->注意此處的save_config失敗
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> set password -->輸入新設(shè)定的密碼驗(yàn)證
Password:
The command completed successfully
LSNRCTL> save_config -->再次save_config成功
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
Saved listener_demo92 configuration parameters.
Listener Parameter File /oracle/92/network/admin/listener.ora
Old Parameter File /oracle/92/network/admin/listener.bak
The command completed successfully
-->增加密碼之后可以看到listener.ora文件中有一條新增的記錄，即密碼選項(xiàng)(注：盡管使用了密碼管理方式,仍然可以無(wú)需密碼啟動(dòng)監(jiān)聽)
[oracle@test admin]$ more listener.ora
#----ADDED BY TNSLSNR 26-JUN-2011 05:12:48---
PASSWORDS_listener_demo92 =
#--------------------------------------------
3. 嘗試未使用密碼的情況下停止監(jiān)聽
[oracle@test ~]$ lsnrctl stop listener_demo92
LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 06:09:51
Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521)))
TNS-01169: The listener has not recognized the password -->收到錯(cuò)誤信息，需要使用密碼認(rèn)證
4. 使用密碼來(lái)停止監(jiān)聽
[oracle@test ~]$ lsnrctl LSNRCTL> set current_listener listener_demo92 Current Listener is listener_demo92 LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password LSNRCTL> set password Password: The command completed successfully LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) The command completed successfully LSNRCTL> status Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 111: Connection refused Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 2: No such file or directory
5. save_config失敗的問題
-->在 Oracle 9i中，使用save_config命令將會(huì)失敗
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<hostname>)(PORT=<port>)))
TNS-01169: The listener has not recognized the password
-->應(yīng)該先使用set password之后再save_config，則保存配置成功。
LSNRCTL> set password
Password: <the password you chose>
The command completed successfully
/*在Oracle 10g 中不會(huì)出現(xiàn)類似的問題，因?yàn)樵?0g中可以使用基于操作系統(tǒng)驗(yàn)證方式。listener將檢測(cè)到如果用戶屬于dba組的成員，
將會(huì)被授予改變密碼，保存配置以及停止監(jiān)聽等權(quán)限。 */
6. 配置listener.ora中ADMIN_RESTRICTIONS參數(shù)
參數(shù)作用：
當(dāng)在listener.ora文件中設(shè)置了ADMIN_RESTRICTIONS參數(shù)后，在監(jiān)聽器運(yùn)行時(shí)，不允許執(zhí)行任何管理命令，同時(shí)set命令將不可用
，不論是在服務(wù)器本地還是從遠(yuǎn)程執(zhí)行都不行。此時(shí)對(duì)于監(jiān)聽的設(shè)置僅僅通過(guò)手工修改listener.ora文件，要使修改生效，只能
使用lsnrctl reload命令或lsnrctl stop/start命令重新載入一次監(jiān)聽器配置信息。
修改方法：
在listener.ora文件中手動(dòng)加入下面這樣一行
ADMIN_RESTRICTIONS_<監(jiān)聽器名> = ON
下面是其它網(wǎng)友的補(bǔ)充：
LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
[oracle@ecp-uc-db1 admin]$ cat listener.ora
#—-ADDED BY TNSLSNR 10-JUN-2011 18:13:24—
PASSWORDS_LISTENER = 6D7AA003392C436A
#——————————————–
note：10g數(shù)據(jù)庫(kù)上需要上添加（重啟監(jiān)聽）
LOCAL_OS_AUTHENTICATION_LISTENER = OFF
1、添加LOCAL_OS_AUTHENTICATION_LISTENER = OFF之前
Security ON: Password or Local OS Authentication
2、添加LOCAL_OS_AUTHENTICATION_LISTENER = OFF之后
Security ON: Password
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> set password 123456
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
STATUS of the LISTENER
————————
Alias LISTENER
Version TNSLSNR for Linux: Version 10.2.0.4.0 – Production
Start Date 10-JUN-2011 18:15:49
Uptime 0 days 0 hr. 1 min. 16 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File /opt/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary…
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ECP-UC-DB1)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary…
Service “PLSExtProc” has 1 instance(s).
Instance “PLSExtProc”, status UNKNOWN, has 1 handler(s) for this service…
Service “ecp” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
Service “ecpXDB” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
Service “ecp_XPT” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
The command completed successfully
相關(guān)文章
在Oracle數(shù)據(jù)庫(kù)中，主要有兩種日志操作模式，分別為非歸檔模式與歸檔模式。默認(rèn)情況下，數(shù)據(jù)庫(kù)采用的是非歸檔模式。作為一個(gè)合格的數(shù)據(jù)庫(kù)管理員，應(yīng)當(dāng)深入了解這兩種日志操作模式的特點(diǎn)，并且在數(shù)據(jù)庫(kù)建立時(shí)，選擇合適的操作模式2013-01-01
這篇文章主要介紹了JDBC連接使用JDBC連接ORACLE的三種URL格式，每種格式通過(guò)實(shí)例代碼給大家介紹的非常詳細(xì)，具有一定的參考借鑒價(jià)值,需要的朋友可以參考下2018-10-10
oracle 聲明游標(biāo)(不具備字段)規(guī)則應(yīng)用
在開發(fā)過(guò)程中可能會(huì)聲明一個(gè)含有某張表不具備字段的游標(biāo),來(lái)解決特殊問題，本文將詳細(xì)介紹這類問題，需要了解更多的朋友可以參考下2012-11-11
oracle執(zhí)行cmd的實(shí)現(xiàn)方法
裝了一個(gè)oracle db11g，于是想試一下網(wǎng)上流傳的在sqlplus中執(zhí)行cmd的一些命令，也不知怎么的，沒一個(gè)好用的，可能是網(wǎng)上轉(zhuǎn)來(lái)轉(zhuǎn)去的轉(zhuǎn)錯(cuò)了．2009-04-04
oracle 將以逗號(hào)隔開的字符串'85,86,87' 轉(zhuǎn)成行2009-06-06
這篇文章主要介紹了Oracle行級(jí)觸發(fā)器的使用,創(chuàng)建觸發(fā)器并使用dblink在插入時(shí)進(jìn)行數(shù)據(jù)同步，本文結(jié)合實(shí)例代碼給大家介紹的非常詳細(xì)，對(duì)大家的學(xué)習(xí)或工作具有一定的參考借鑒價(jià)值，需要的朋友可以參考下2023-05-05
oracle 監(jiān)聽 lsnrctl 命令 (推薦)
這篇文章主要介紹了oracle 監(jiān)聽 lsnrctl 命令 ,非常不錯(cuò)，具有參考借鑒價(jià)值，需要的朋友可以參考下2017-03-03
oracle 12c創(chuàng)建可插拔數(shù)據(jù)庫(kù)（PDB）與用戶詳解
Oracle12c 中，增加了可插接數(shù)據(jù)庫(kù)的概念，即PDB，允許一個(gè)數(shù)據(jù)庫(kù)容器（CDB）承載多個(gè)可插拔數(shù)據(jù)庫(kù)（PDB）。下面這篇文章主要給大家介紹了利用oracle 12c創(chuàng)建可插拔數(shù)據(jù)庫(kù)（PDB）與用戶的相關(guān)資料，文中介紹的很詳細(xì)，需要的朋友可以參考借鑒，下面來(lái)一起看看吧。2017-02-02
Oracle通過(guò)procedure調(diào)用webservice接口的全過(guò)程
存儲(chǔ)過(guò)程是一組為了完成特定功能的sql語(yǔ)句集合,經(jīng)過(guò)編譯后存儲(chǔ)在數(shù)據(jù)庫(kù)中,用戶通過(guò)制定存儲(chǔ)過(guò)程的名字并給出參數(shù)（如果該過(guò)程帶有參數(shù)）來(lái)執(zhí)行他,本文介紹了Oracle通過(guò)procedure調(diào)用webservice接口的全過(guò)程,需要的朋友可以參考下2024-07-07
Oracle 手動(dòng)創(chuàng)建數(shù)據(jù)庫(kù)步驟詳解
本文給大家介紹oracle手動(dòng)創(chuàng)建數(shù)據(jù)庫(kù)步驟,需要的朋友可以參考下2015-10-10