ORACLE資料庫安全漏洞之監聽密碼設定

    Oracle相關元件安全防範做的可謂真夠全面，當然監聽程式也有相關的安全設定；預設狀態下，使用者不需要使用任何密碼即透過lsnrctl 工具對Oracle Listener進行操作或關閉，可造成新的會話無法建立連線；Oracle監聽器允許利用lsnrctl從遠端發起對監聽器的管理，也容易導致資料庫受到損壞。另外，ORACLE資料庫監聽器的管理9i與10g和11g還有點區別，9i資料庫透過lsnrctl設定密碼就會過濾系統認證，而10g和11g監聽lsnrctl設定密碼後不會自動生效，需要取消作業系統認證方能使監聽密碼設定生效。
   這裡特別提示11G監聽密碼設定
1、在ORACLE使用者下，shell裡輸入lsnrctl回車可進入監聽程式管理控制檯
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:33:57
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> 

2、在監聽管理控制檯輸入help可以檢視監聽管理命令
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start               stop                status              
services            version             reload              
save_config         trace               spawn               
change_password     quit                exit                
set*                show*  

3、監聽未設定密碼時oracle會話可使用lsnrctl啟停監聽程式（這也是監聽程式的風險），啟停監聽
[oracle@orcl11g admin]$ lsnrctl stop
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:38:13
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
[oracle@orcl11g admin]$ 
[oracle@orcl11g admin]$ lsnrctl start
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:50
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 15:39:50
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:39:54
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 15:39:50
Uptime                    0 days 0 hr. 0 min. 3 sec
Trace Level               off
Security                  ON: Password or Local OS Authentication
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
[oracle@orcl11g admin]$ 

4、這裡使用lsnrctl管理工具為Oracle資料庫監聽設定密碼
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 15:41:35
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start               stop                status              
services            version             reload              
save_config         trace               spawn               
change_password     quit                exit                
set*                show*               
LSNRCTL> change_password
Old password:<如果監聽設定過密碼則輸入舊密碼> 
New password: <輸入新密碼>
Reenter new password: <輸入新密碼確認>
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> set password #設定控制檯密碼
Password: 
The command completed successfully
LSNRCTL> save_config #儲存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Old Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.bak
The command completed successfully
LSNRCTL> 

5、測試密碼安全設定是否生效（注意：需要reload或重啟監聽）
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> 

6、驗證監聽密碼設定是否生效（注意：9i版本的是生效的，這裡強調的是10g或11g使用了作業系統認證，監聽的密碼設定不自動生效）
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL>
可見，雖然監聽設定了密碼保護，但是由於11g使用了作業系統認證，監聽的密碼保護策略沒有生效

7、在監聽listener.ora配置檔案中取消作業系統認證
SID_LIST_ORCL11G=
   (SID_LIST=
(SID_DESC=
          (GLOBAL_DBNAME=ORCL11G)
          (SID_NAME=ORCL11G)
          (ORACLE_HOME=/oracle/app/oracle/product/11.2.0.3/db)
         (PRESPAWN_MAX=20)
 (PRESPAWN_LIST=
           (PRESPAWN_DESC=(PROTOCOL=tcp)(POOL_SIZE=2)(TIMEOUT=1))
         )
        )
       )

LOCAL_OS_AUTHENTICATION_listener=OFF

#----ADDED BY TNSLSNR 08-JUL-2015 14:00:26---
PASSWORDS_LISTENER = FC996BE8FB638140
#--------------（這裡就是監聽設定了密碼的標識了）------------------------------

8、在listener.ora配置取消作業系統認證後重啟監聽，重新驗證監聽密碼是否生效
[oracle@orcl11g admin]$ lsnrctl status
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:10:18
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
TNS-01169: The listener has not recognized the password
[oracle@orcl11g admin]$
可見，密碼保護已經生效了

9、資料庫監聽設定了密碼保護後，再管理資料庫監聽就需要透過lsnrctl 管理控制檯使用set命令先設定密碼了
[oracle@orcl11g admin]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.3.0 - Production on 08-JUL-2015 16:12:18
Copyright (c) 1991, 2011, Oracle.  All rights reserved.
Welcome to LSNRCTL, type "help" for information.
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password: 
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 16:08:52
Uptime                    0 days 0 hr. 4 min. 21 sec
Trace Level               off
Security                  ON: Password
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Services Summary...
Service "orcl11g" has 1 instance(s).
  Instance "orcl11g", status READY, has 1 handler(s) for this service...
Service "orcl11gXDB" has 1 instance(s).
  Instance "orcl11g", status READY, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
The command completed successfully
LSNRCTL> start
Starting /oracle/app/oracle/product/11.2.0.3/db/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 11.2.0.3.0 - Production
System parameter file is /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Log messages written to /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=orcl11g)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 11.2.0.3.0 - Production
Start Date                08-JUL-2015 16:13:25
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  ON: Password
SNMP                      OFF
Listener Parameter File   /oracle/app/oracle/product/11.2.0.3/db/network/admin/listener.ora
Listener Log File         /oracle/app/oracle/diag/tnslsnr/orcl11g/listener/alert/log.xml
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=orcl11g)(PORT=1521)))
  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1521)))
The listener supports no services
The command completed successfully
LSNRCTL> 

10、重要提示，一旦設定了密碼後，需要牢記密碼，否則以後管理資料庫監聽會比較麻煩。