linux oracle加固,Oracle的一些安全加固配置

接下来测试下结果，当然要重启下linstener。

[Oracle@test admin]$ lsnrctl stop

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:39:39

Copyright (c) 1991, 2010, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

TNS-01169: The listener has not recognized the password

[oracle@test admin]$ lsnrctl status

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:39:48

Copyright (c) 1991, 2010, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

TNS-01169: The listener has not recognized the password

可以看到上面的stop和status操作都失败了，如下操作是成功的：

[oracle@test admin]$ lsnrctl

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:40:00

Copyright (c) 1991, 2010, Oracle.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> stop

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

TNS-01169: The listener has not recognized the password

LSNRCTL> set password

Password:

The command completed successfully

LSNRCTL> stop

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

The command completed successfully

LSNRCTL> start

Starting /u01/oracle/10g/product/10.2.0/db_1/bin/tnslsnr: please wait...

TNSLSNR for Linux: Version 10.2.0.5.0 - Production

System parameter file is /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora

Log messages written to /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log

Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))

Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

STATUS of the LISTENER

------------------------

Alias                     LISTENER

Version                   TNSLSNR for Linux: Version 10.2.0.5.0 - Production

Start Date                08-AUG-2012 14:40:33

Uptime                    0 days 0 hr. 0 min. 0 sec

Trace Level               off

Security                  ON: Password

SNMP                      OFF

Listener Parameter File   /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora

Listener Log File         /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))

Services Summary...

Service "PLSExtProc" has 1 instance(s).

Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...

Service "gt10g" has 1 instance(s).

Instance "gt10g", status UNKNOWN, has 1 handler(s) for this service...

The command completed successfully

LSNRCTL> status

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))

STATUS of the LISTENER

------------------------

Alias                     LISTENER

Version                   TNSLSNR for Linux: Version 10.2.0.5.0 - Production

Start Date                08-AUG-2012 14:40:33

Uptime                    0 days 0 hr. 0 min. 2 sec

Trace Level               off

Security                  ON: Password

SNMP                      OFF

Listener Parameter File   /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora

Listener Log File         /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))

(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))

Services Summary...

Service "PLSExtProc" has 1 instance(s).

Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...

Service "gt10g" has 2 instance(s).

Instance "gt10g", status UNKNOWN, has 1 handler(s) for this service...

Instance "gt10g", status READY, has 1 handler(s) for this service...

Service "gt10gXDB" has 1 instance(s).

Instance "gt10g", status READY, has 1 handler(s) for this service...

Service "gt10g_XPT" has 1 instance(s).

Instance "gt10g", status READY, has 1 handler(s) for this service...

The command completed successfully

3. 设置连接IP限制

通过修改sqlnet.ora配置文件，以限制来源IP是否可以访问数据库：

tcp.validnode_checking = yes

tcp.invited_nodes = (localhost,ip1,ip2)

注意，一定要把本机的地址添加进去，否则连数据库本机都无法注册到监听。

-The End-