昨天看三思的mysql 看到一節說 mysql 建立使用者 :
CREATE USER 'usernmae'@'192.168.2.3' IDENTIFIED BY 'password' 是表明只有從192.168.2.3 發起的usernmae 訪問才被允許接入。
聯想到ORACLE 也有登入策略透過sqlnet.ora 設定引數限制IP訪問策略。
參考文件(Doc ID 462933.1)：
metalink
In this Document
Goal
Fix
APPLIES TO:
Oracle Net Services - Version 9.2.0.1.0 and later
Information in this document applies to any platform.
此功能適合於9.2.0.1.0 以後的版本
GOAL
How to control access to the database and understand validnode checking.
透過節點檢查控制訪問資料庫
FIX

You can configure the sqlnet.ora file to allow and deny access to the database via the validnode checking parmeters. (Earlier versions of Oracle, 8i and lower used the protocol.ora file)
透過在sqlnet.ora 裡面配置引數控制透過或者拒絕訪問資料庫，8i之前的資料庫是配置protocol.ora檔案
TCP.VALIDNODE_CHECKING
TCP.VALIDNODE_CHECKING 引數
Use to specify whether to screen access to the database.Value is either YES or ON
指定是否設定保護資料庫

TCP.EXCLUDED_NODES
Use to specify which clients using the TCP/IP protocol are denied access to the database. Hostname and ipaddress can be used
TCP.EXCLUDED_NODES 引數
設定資料庫拒絕訪問的IP 使用tcp/ip 協議。主機名和ip地址都可使用
TCP.INVITED_NODES
Use to specify which clients using the TCP/IP protocol are allowed access to the database. Hostname and ipadddress can be used.
Example sqlnet.ora file (set where database is running)
TCP.INVITED_NODES 引數
設定資料庫透過訪問的IP 使用tcp/ip 協議。主機名和ip地址都可使用

注意設定了的時候必須包括本機
TCP.VALIDNODE_CHECKING = YES
TCP.EXCLUDED_NODES= (138.3.33.33)
TCP.INVITED_NODES=(138.4.44.44, hammer)
注意設定了的時候必須包括本機
Would cause the SQL*plus from client "138.3.33.33" to error

sqlplus scott/tiger@orcl
SQL*Plus: Release 10.2.0.1.0 - Production on Tue Oct 16 11:48:40 2007
Copyright (c) 1982, 2005, Oracle. All rights reserved.

ERROR:
ORA-12537: TNS:connection closed
Level 16 listener trace will show

nttvlser: valid node check on incoming node 138.3.33.33
nttvlser: Denied Entry: 138.3.33.33
nttcon: exit
nserror: entry
nserror: nsres: id=1, p=65, ns=12546, ns2=12560; nt[0]=516, nt[1]=0, nt[2]=0; ora[0]=0, ora[1]=0, ora[2]=

Listener log will show

16-OCT-2007 11:48:40 * 12546
TNS-12546: TNS:permission denied
TNS-12560: TNS:protocol adapter error
TNS-00516: Permission denied
But would allow connections from machines "138.4.44.44" and "hammer" to pass.Please note that without the servers host name or ip address in the invited list, then PMON will not register with the listener.

Any changes to the values requires the TNS listener to be reloaded
All host names must be resolvable or the TNS listener will not start
Invited list takes precedence over excluded listed
All entries must be on one line(Best to add entries via Net Manager)
SCAN and TCP.INVITED_NODES will require the SCAN VIPs and Node Vips to be added to the Grid Infrastructure SQLNET.ORA file.

ORACLE 11g sqlnet.ora 設定限制IP 訪問

相關文章