1024问

Oracle 监听器密码设置方法(LISTENER)

Lecea ·
更新时间:2024-09-20
· 964 次阅读

监听器也有安全？Sure！在缺省的情况下，任意用户不需要使用任何密码即通过lsnrctl 工具对Oracle Listener进行操作或关闭，从而造成任意新的会话都将无法建立连接。在Oracle 9i 中Oracle监听器允许任何一个人利用lsnrctl从远程发起对监听器的管理。也容易导致数据库受到损坏。

1. 未设定密码情形下停止监听

[oracle@test ~]$ lsnrctl stop listener_demo92 -->停止监听，可以看出不需要任何密码即可停止 LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:22:26 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) The command completed successfully

2. 重新启动监听并设置密码

[oracle@test ~]$ lsnrctl LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 08:24:09 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Welcome to LSNRCTL, type "help" for information. LSNRCTL> set current_listener listener_demo92 -->设置当前监听器 Current Listener is listener_demo92 LSNRCTL> start -->启动过程也不需要任何密码,启动的详细信息省略 LSNRCTL> change_password -->使用change_password来设置密码 Old password: New password: Reenter new password: Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) Password changed for listener_demo92 The command completed successfully LSNRCTL> save_config -->注意此处的save_config失败 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password LSNRCTL> set password -->输入新设定的密码验证 Password: The command completed successfully LSNRCTL> save_config -->再次save_config成功 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) Saved listener_demo92 configuration parameters. Listener Parameter File /oracle/92/network/admin/listener.ora Old Parameter File /oracle/92/network/admin/listener.bak The command completed successfully -->增加密码之后可以看到listener.ora文件中有一条新增的记录，即密码选项(注：尽管使用了密码管理方式,仍然可以无需密码启动监听) [oracle@test admin]$ more listener.ora #----ADDED BY TNSLSNR 26-JUN-2011 05:12:48--- PASSWORDS_listener_demo92 = #--------------------------------------------

3. 尝试未使用密码的情况下停止监听

[oracle@test ~]$ lsnrctl stop listener_demo92 LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 26-JUN-2011 06:09:51 Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved. Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password -->收到错误信息，需要使用密码认证

4. 使用密码来停止监听

[oracle@test ~]$ lsnrctl LSNRCTL> set current_listener listener_demo92 Current Listener is listener_demo92 LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-01169: The listener has not recognized the password LSNRCTL> set password Password: The command completed successfully LSNRCTL> stop Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) The command completed successfully LSNRCTL> status Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test)(PORT=1521))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 111: Connection refused Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC))) TNS-12541: TNS:no listener TNS-12560: TNS:protocol adapter error TNS-00511: No listener Linux Error: 2: No such file or directory

5. save_config失败的问题

-->在 Oracle 9i中，使用save_config命令将会失败 LSNRCTL> save_config Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<hostname>)(PORT=<port>))) TNS-01169: The listener has not recognized the password -->应该先使用set password之后再save_config，则保存配置成功。 LSNRCTL> set password Password: <the password you chose> The command completed successfully /*在Oracle 10g 中不会出现类似的问题，因为在10g中可以使用基于操作系统验证方式。listener将检测到如果用户属于dba组的成员， 将会被授予改变密码，保存配置以及停止监听等权限。 */

6. 配置listener.ora中ADMIN_RESTRICTIONS参数

参数作用：
当在listener.ora文件中设置了ADMIN_RESTRICTIONS参数后，在监听器运行时，不允许执行任何管理命令，同时set命令将不可用
，不论是在服务器本地还是从远程执行都不行。此时对于监听的设置仅仅通过手工修改listener.ora文件，要使修改生效，只能
使用lsnrctl reload命令或lsnrctl stop/start命令重新载入一次监听器配置信息。
修改方法：
在listener.ora文件中手动加入下面这样一行
ADMIN_RESTRICTIONS_<监听器名> = ON

下面是其它网友的补充：

LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
[oracle@ecp-uc-db1 admin]$ cat listener.ora
#—-ADDED BY TNSLSNR 10-JUN-2011 18:13:24—
PASSWORDS_LISTENER = 6D7AA003392C436A
#——————————————–
note：10g数据库上需要上添加（重启监听）
LOCAL_OS_AUTHENTICATION_LISTENER = OFF

1、添加LOCAL_OS_AUTHENTICATION_LISTENER = OFF之前

Security ON: Password or Local OS Authentication

2、添加LOCAL_OS_AUTHENTICATION_LISTENER = OFF之后

Security ON: Password
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> set password 123456
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ecp-uc-db1)(PORT=1521)))
STATUS of the LISTENER
————————
Alias LISTENER
Version TNSLSNR for Linux: Version 10.2.0.4.0 – Production
Start Date 10-JUN-2011 18:15:49
Uptime 0 days 0 hr. 1 min. 16 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /opt/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File /opt/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary…
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ECP-UC-DB1)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary…
Service “PLSExtProc” has 1 instance(s).
Instance “PLSExtProc”, status UNKNOWN, has 1 handler(s) for this service…
Service “ecp” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
Service “ecpXDB” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
Service “ecp_XPT” has 1 instance(s).
Instance “ecp”, status READY, has 1 handler(s) for this service…
The command completed successfully

您可能感兴趣的文章:Oracle监听器被优化大师挂掉后的完美解决方法Linux下重启oracle服务及监听器和实例详解Oracle监听口令及监听器安全详解Oracle监听器服务不能启动的解决方法Oracle 11g2的监听器配置教程Oracle安装监听器错误的解决方法



监听 方法 监听器 Oracle

1024 个赞
编辑 举报
需要 登录 后方可回复, 如果你还没有账号请 注册新账号
相关文章
Python File(文件) 方法
Emily 2020-05-26
734
C++ 数据封装
Fawn 2021-04-14
728
Laravel 中使用简单的方法跟踪用户是否在线(推荐)
Serwa 2020-03-20
874
基于Laravel 多个中间件的执行顺序详解
Nafisa 2021-06-30
708
docker网卡的IP地址修改方法总结
Rae 2023-07-22
1847
docker命令中必须加上sudo的问题解决方法
Rhoda 2023-07-22
1038
Elasticsearch/Kibana密码设置方法
Hester 2023-07-22
1081
docker查询日志并输出到文件的方法
Grace 2023-07-22
1029
docker容器/etc/hosts文件修改方法
Vanna 2023-07-22
1279
docker容器连接宿主机redis与mysql的配置方法
Peony 2023-07-22
1975
Docker镜像之不同服务器间迁移方法大全
Dorothy 2023-07-22
1993
docker容器使用内存大小限制方法
Dulcea 2023-07-22
493
在Linux中列出Systemd下所有正在运行的服务的方法指南
Zandra 2023-07-22
507
一文详解Python中多进程和进程池的使用方法
Serafina 2023-07-24
338
VMware克隆虚拟机并重新设置IP和主机名的实现方法
Kathy 2023-08-08
194
使用nginx.exe时闪退的原因和解决方法
Olivia 2023-08-08
694
阿里云服务IIS搭建Web网站外网无法访问的解决方法
Elina 2023-08-08
897
ssh报错nokeyalg的解决方法(关于低版本连接高版本ssh)
Jacinthe 2023-08-08
339
在没有Docker缓存的情况下构建镜像的方法分享
Viridis 2023-08-08
1779
docker-compose中启动镜像失败的几种解决方法
Hana 2023-08-08
725