Oracle 安全

Oracle 安全

 

1.監聽設定密碼

oracle@cmwapgw1:~> lsnrctl 

LSNRCTL for Linux: Version 9.2.0.4.0 - Production on 18-AUG-2012 03:04:11

Copyright (c) 1991, 2002, Oracle Corporation.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> set current_listener
Current Listener is LISTENER
LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.1.11)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.1.11)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File   /opt/oracle/product/9.2.0/network/admin/listener.ora
Old Parameter File   /opt/oracle/product/9.2.0/network/admin/listener.bak
The command completed successfully
LSNRCTL> exit

 

oracle@cmwapgw1:~> more /opt/oracle/product/9.2.0/network/admin/listener.ora
# LISTENER.ORA Network Configuration File: /opt/oracle/product/9.2.0/network/admin/listener.ora
# Generated by Oracle configuration tools.

SID_LIST_LISTENER =(SID_LIST = (SID_DESC = (SID_NAME = PLSExtProc) (ORACLE_HOME = /opt/oracle/product/9.2.0) (PROGRAM = extproc)))

LISTENER =(DESCRIPTION_LIST = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.1.11)(PORT = 1521))) (ADDRESS_LIST = (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC)))))

#----ADDED BY TNSLSNR 18-AUG-2012 03:04:56---
PASSWORDS_LISTENER = 1DF5C2FD0FE9CFA2-----------------------------------監聽設定的密碼
#--------------------------------------------

 

oracle@cmwapgw1:~> lsnrctl stop

LSNRCTL for Linux: Version 9.2.0.4.0 - Production on 18-AUG-2012 03:08:34

Copyright (c) 1991, 2002, Oracle Corporation.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.1.11)(PORT=1521)))
TNS-01169: The listener has not recognized the password

 

可以看出，監聽設定密碼後，不能直接在通過lsnrctl stop停止監聽，需要lsnrctl進入監聽再進行相關操作

 

Oracle密碼安全
SQL> alter profile DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS 6;

SQL> alter profile DEFAULT LIMIT PASSWORD_REUSE_MAX 5;

SQL> alter profile DEFAULT LIMIT PASSWORD_LIFE_TIME 90;

SQL> @?/rdbms/admin/utlpwdmg

SQL> alter profile DEFAULT LIMIT PASSWORD_VERIFY_FUNCTION verify_function;

 

 

Oracle安全加固選項操作如下

 

Oracle重建密碼檔案(需重啟資料庫)

oracle@linux-u72z:~> cd $ORACLE_HOME/dbs/

oracle@linux-u72z:~/product/9.2.0/dbs> orapwd file=orapw password=oracle entries=10;

SQL> shutdown immeidate;

SQL> startup;

SQL> select * from v$pwfile_users;

USERNAME                       SYSDB SYSOP
------------------------------ ----- -----
SYS                            TRUE  TRUE

 

 

Oracle10g修改WEEKNIGHT_WINDOW、WEEKEND_WINDOW

begin
  sys.dbms_scheduler.set_attribute(name => 'SYS.WEEKNIGHT_WINDOW', attribute => 'repeat_interval', value => 'Freq=daily;ByDay=MON,TUE,WED,THU,FRI;ByHour=01;ByMinute=0;BySecond=0');
end;
/

 

begin
  sys.dbms_scheduler.set_attribute(name => 'SYS.WEEKEND_WINDOW', attribute => 'repeat_interval', value => 'Freq=daily;ByDay=Sat, Sun;ByHour=01;ByMinute=0;BySecond=0');
  sys.dbms_scheduler.set_attribute(name => 'SYS.WEEKEND_WINDOW', attribute => 'duration', value => '0 08:00:00');
end;
/