Oracle监听管理-动态注册服务有效节点注册检查（VNCR） (Doc ID 2226611.1)-远程监听TNS投毒

适用于:
Oracle Net Services - 版本 11.2.0.4 到 12.1.0.2 [发行版 11.2 到 12.1]
本文档所含信息适用于所有平台
介绍listener新的注册相关的安全功能 - 有效节点检查功能。11.2.0.4以及更高版本里引入这个功能是为了解决下面的安全问题：
alert-cve-2012-1675https://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html
用途
 VNCR 是 Oracle Net 11.2.0.4 和 12c 的一个新特性，只允许注册实例来自允许的服务器。

仅当注册来自于一个有效节点时才允许注册成功，该想法确保了 listener 的安全性。
通过 listener.ora 文件，用户可以指定允许注册的节点列表，或者排除掉的节点列表。
这消除了复杂的 COST 设置来确保恶意的服务器不会注册到 listener。
同一台主机不能同时出现在邀请和排除列表中。如果同时指定了，则邀请节点优先。
该特性独立于客户端使用的有效节点检查。
适用范围
详细信息

如果没有手工配置，12c listener（默认）不允许远程服务器注册它们的数据库实例。远程注册将会导致 TNS-01182 错误记录到 listener.log 文件中。这是正常行为，因为 listener 默认只允许注册的实例来自与 listener 相同的机器。

注意：Oracle 11.2.0.4上，

VALID_NODE_CHECKING_REGISTRATION_listener_name 默认 是OFF，必须设置成 ON 来启用阻塞远程注册的功能。

为了允许远程实例注册到 12c listener，在 listener.ora 文件中启用 VNCR。

参见只影响 HPUX Itanium 系统的  BUG 20438237 VNCR doesn't work on RAC 

VALID_NODE_CHECKING_REGISTRATION_listener_name
参数值：
     OFF/0 - 禁用 VNCR
     ON/1/LOCAL - 默认。启用 VNCR。所有本地机器 IPs 都可以注册。
     SUBNET/2 - 子网下的所有机器都允许注册。

REGISTRATION_INVITED_NODES_listener-name
 参数值是有效 IP，有效主机，子网使用 CIDR 标记法（对于 ip4/6/），或者通配符(*)对于 ipv4。例如：REGISTRATION_INVITED_NODES_Listener=(net-vm1, 127.98.45.209, 127.42.5.*)

注意当设置了 INVITED 列表，它会自动在列表中包含机器的本地 IP。没有必要将其列入。

注意：对于12c GRID 环境，这个参数一般被CRS agent所管理。也适用于GRID环境里的standalone DB。对于GRID管理的standalone DB，agent可能会自动添加下面的配置到

关于12.2版本更多信息，请参考下面的文档：

http://docs.oracle.com/database/122/NETAG/NETAG.pdf

1.  非RAC/集群环境

~~~~~~~~~~
请注意上面的信息主要是针对RAC/集群环境。
对于非集群环境下的11.2.0.4 standalone listener(不属于grid infrastucture管理的)，

只需要下面的行即可
VALID_NODE_CHECKING_REGISTRATION_listener_name = ON
* 不管动态注册还是静态注册的11.2.0.4 listener，基于安全的原因，都应该设置上面这一行。

---

    2 对于集群环境如下;

listener.ora:

VALID_NODE_CHECKING_REGISTRATION_listener_name=SUBNET

REGISTRATION_EXCLUDED_NODES_listener_name – 和 INVITED_NODES 相比正好相反

Sample listener.ora file:

LISTENER=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER)))) # line added by Agent 
MGMTLSNR=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=MGMTLSNR)))) # line added by Agent 
# listener.ora Network Configuration File: /u01/app/12.1.0.2/grid/network/admin/listener.ora 
# Generated by Oracle configuration tools.

ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN3 = ON

ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN2 = ON

ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN1 = ON

ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER = ON

LISTENER_SCAN3 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = LISTENER_SCAN3)) ) )

LISTENER_SCAN2 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = LISTENER_SCAN2)) ) )

LISTENER_SCAN1 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = LISTENER_SCAN1)) ) )

ENABLE_GLOBAL_DYNAMIC_ENDPOINT_MGMTLSNR=ON # line added by Agent 

ADMIN_RESTRICTIONS_ADMIN=ON ENABLE_GLOBAL_DYNAMIC_ENDPOINT_EBSPRD01=ON # line added by Agent

集群环境 需要注明 scan1的INvited nodes

VALID_NODE_CHECKING_REGISTRATION_MGMTLSNR=SUBNET # line added by Agent
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN3=OFF # line added by Agent 
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN2=OFF # line added by Agent

VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=OFF # line added by Agent

集群配置

VALID_NODE_CHECKING_REGISTRATION_LISTENER = ON

VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1= ON

REGISTRATION_INVITED_NODES_LISTENER=(hostip all nodes，vip all nodes)

VALID_NODE_CHECKING_REGISTRATION_LISTENER = ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1= ON
REGISTRATION_INVITED_NODES_LISTENER=(20.120.204.207,20.120.204.208,20.120.204.209,20.120.204.210,20.120.204.211,20.120.60.202,20.120.60.203)
REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(20.120.204.207,20.120.204.208,20.120.204.209,20.120.204.210,20.120.204.211,20.120.60.202,20.120.60.203)
 

lsnrctl reload

lsnrct reload listener_scan1

---

1 单实例配置案例分析 

测试229.42像229.12注册服务。

1 对于单实例数据库环境，在$ORACLE_HOME/network/admin/listener.ora文件中添加如下

VALID_NODE_CHECKING_REGISTRATION_listener_nscs=ON

---

2 远程实例添加remote_listener参数
alter system set remote_listener='(ADDRESS=(PROTOCOL=TCP)(HOST=10.228.229.12)(PORT=1521))'

TNS-01182: Listener rejected registration of service ""
Wed Dec 25 05:41:51 2019
25-DEC-2019 05:41:51 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=orcldb01)(USER=orcldb))(COMMAND=services)(ARGUMENTS=64)(SERVICE=listener_nscs)(VERSION=186647552)) * services * 0
25-DEC-2019 05:41:52 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=orcldb01)(USER=orcldb))(COMMAND=services)(ARGUMENTS=64)(SERVICE=listener_nscs)(VERSION=186647552)) * services * 0
Wed Dec 25 05:42:34 2019
25-DEC-2019 05:42:34 * service_register * nscs * 0
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:38 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Wed Dec 25 05:42:46 2019
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:46 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:46 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:47 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:47 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:47 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:48 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:48 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:48 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:48 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""
Listener(VNCR option 1) rejected Registration request from destination 10.228.229.42
25-DEC-2019 05:42:49 * service_register_NSGR * 1182
TNS-01182: Listener rejected registration of service ""