查看本地oracle版本,【LISTENER】Oracle 10g监听的本地操作系统认证（Local OS Authentication）安全特性...

Oracle 10g版本以及之后的版本中推出了监听的本地操作系统认证安全特性，即Local OS Authentication。这个安全特性简言之：若监听程序是在当前用户下启动的，则当前用户具有管理监听的所有权利，其他用户对监听的管理将受到限制。注意，这里启动和管理监听的用户不一定是oracle用户。本文将就此特性给出实际验证。1.查看监听的安全特性在oracle用户下查看监听状态。ora10g@secdb /home/oracle$ lsnrctl statusLSNRCTL for Linux: Version 10.2.0.1.0 - Production on 22-MAR-2011 22:04:03Copyright (c) 1991, 2005, Oracle.  All rights reserved.Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))STATUS of the LISTENER------------------------Alias                     LISTENERVersion                   TNSLSNR for Linux: Version 10.2.0.1.0 - ProductionStart Date                21-MAR-2011 22:51:53Uptime                    0 days 23 hr. 12 min. 9 secTrace Level               offSecurity                  ON: Local OS AuthenticationSNMP                      OFFListener Log File         /oracle/ora10gR2/product/10.2.0/db_2/network/log/listener.logListening Endpoints Summary...(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=secdb)(PORT=1521)))Services Summary...Service "ora10g" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora10gXDB" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora10g_XPT" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora11g" has 1 instance(s).Instance "ora11g", status READY, has 1 handler(s) for this service...The command completed successfully注意status命令返回的“Security ON: Local OS Authentication”信息，此条提示信息表明监听处于Local OS Authentication认证模式。2.尝试在非oracle用户下停止监听从oracle用户切换到操作系统secooler用户。ora10g@secdb /home/oracle$ su - secoolerPassword:ora10g@secdb /home/secooler$ iduid=666(secooler) gid=501(oinstall) groups=501(oinstall),502(dba),503(oper)尝试在secooler用户下停止监听程序。ora10g@secdb /home/secooler$ lsnrctl stop listenerLSNRCTL for Linux: Version 10.2.0.1.0 - Production on 22-MAR-2011 22:01:58Copyright (c) 1991, 2005, Oracle.  All rights reserved.Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))TNS-01190: The user is not authorized to execute the requested listener command可见，此时返回TNS-01190错误，此条错误便是监听的本地操作系统认证特性在起作用。因为此环境中监听是由oracle用户启动的。3.尝试非oracle用户启动监听程序1)在oracle用户中停掉监听程序ora10g@secdb /home/oracle$ lsnrctl stopLSNRCTL for Linux: Version 10.2.0.1.0 - Production on 22-MAR-2011 22:07:16Copyright (c) 1991, 2005, Oracle.  All rights reserved.Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))The command completed successfully2)在secooler用户中启动监听ora10g@secdb /home/secooler$ lsnrctlLSNRCTL for Linux: Version 10.2.0.1.0 - Production on 22-MAR-2011 22:07:24Copyright (c) 1991, 2005, Oracle.  All rights reserved.Welcome to LSNRCTL, type "help" for information.LSNRCTL> startStarting /oracle/ora10gR2/product/10.2.0/db_2/bin/tnslsnr: please wait...TNSLSNR for Linux: Version 10.2.0.1.0 - ProductionLog messages written to /oracle/ora10gR2/product/10.2.0/db_2/network/log/listener.logListening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=secdb)(PORT=1521)))Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))STATUS of the LISTENER------------------------Alias                     LISTENERVersion                   TNSLSNR for Linux: Version 10.2.0.1.0 - ProductionStart Date                22-MAR-2011 22:08:10Uptime                    0 days 0 hr. 0 min. 0 secTrace Level               offSecurity                  ON: Local OS AuthenticationSNMP                      OFFListener Log File         /oracle/ora10gR2/product/10.2.0/db_2/network/log/listener.logListening Endpoints Summary...(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=secdb)(PORT=1521)))The listener supports no servicesThe command completed successfully可见，监听顺利启动，稍等片刻，等待数据库实例动态注册到监听。在secooler用户下查看监听状态LSNRCTL> statusConnecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))STATUS of the LISTENER------------------------Alias                     LISTENERVersion                   TNSLSNR for Linux: Version 10.2.0.1.0 - ProductionStart Date                22-MAR-2011 22:08:10Uptime                    0 days 0 hr. 0 min. 20 secTrace Level               offSecurity                  ON: Local OS AuthenticationSNMP                      OFFListener Log File         /oracle/ora10gR2/product/10.2.0/db_2/network/log/listener.logListening Endpoints Summary...(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=secdb)(PORT=1521)))Services Summary...Service "ora10g" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora10gXDB" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora10g_XPT" has 1 instance(s).Instance "ora10g", status READY, has 1 handler(s) for this service...Service "ora11g" has 1 instance(s).Instance "ora11g", status READY, has 1 handler(s) for this service...The command completed successfully此时，监听在secooler用户下运行正常。可以通过ps命令再次确定监听的确是由secooler用户启动的。ora10g@secdb /home/secooler$ ps -ef | grep -i listener | grep -v grepsecooler  5794     1  0 22:08 ?        00:00:00 /oracle/ora10gR2/product/10.2.0/db_2/bin/tnslsnr LISTENER -inherit4.回到oracle用户尝试关闭监听由于此时监听程序是在secooler用户下启动的，根据Local OS Authentication特性，此时oracle用户是无权关闭监听程序的。验证一下。ora10g@secdb /home/oracle$ lsnrctl stopLSNRCTL for Linux: Version 10.2.0.1.0 - Production on 22-MAR-2011 22:27:36Copyright (c) 1991, 2005, Oracle.  All rights reserved.Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))TNS-01190: The user is not authorized to execute the requested listener command结论得以证实。此时oracle用户无法停止由secooler用户启动的监听程序。5.被限制的监听操作命令列表本文是以关闭监听程序为例进行演示的。除了STOP操作之外被限制使用的命令如下所示。SAVE_CONFIG, TRACE, SPAWN, RELOAD,SET {LOG_FILE, LOG_STATUS, INBOUND_CONNECT_TIMEOUT, SAVE_CONFIG_STOP_ON, TRC_FILE, TRC_LEVEL, LOG_DIRECTORY, STARTUP_WAITTIME}SHOW {RULES, TRC_DIRECTORY, LOG_FILE, LOG_STATUS, INBOUND_CONNECT_TIMEOUT, SNMP_VISIBLE, TRC_FILE, TRC_LEVEL, LOG_DIRECTORY, STARTUP_WAITTIME, SAVE_CONFIG_STOP_ON}在非启动监听用户下执行上述命令均会收到TNS-01190错误。6.小结Oracle 10g的本地操作系统认证(Local OS Authentication)安全特性避免了监听管理过程中的混乱现象。在理解了这个特性真实意图后，监听的安全性便有了保证。Good luck.secooler11.03.22-- The End --