리스너에 패스워드 걸기

리스너에 패스워드를 설정해 보안을 강화할 수 있다.

리스너에 패스워드를 설정하게 되면 
lsnrctl(리스너 컨트롤) 명령어로 status(리스너 프로세스 상태 정보 확인) 와 stop(리스너 프로세스 정지)을 하기 위해서는
이 패스워드를 설정한 후에야 가능하다.
단, start는 패스워드 설정없이도 가능하다.

그러면 지금부터 따라해보자. (참고로 오라클 버전은 10.2.0.4이고, 실습은 모두 default 리스너로 실행)
순서는 아래와 같다.

1. 패스워드 설정 안함
  1). listener.ora 파일 확인
  2). listener start
  3). listener status 확인
  4). listener stop

2. 패스워드 설정
  1). listener.ora 파일 확인
  2). listener start
  3). set passwd
  4). listener.ora 파일 확인
  5). listener status 확인
  6). listener stop

---

1. 패스워드 설정안함
  1). listener.ora 파일 확인

os] vi $ORACLE_HOME/network/admin/listener.ora

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = PLSExtProc)
      (ORACLE_HOME = /u01/app/oracle/product/10.2.0/db_1)
      (PROGRAM = extproc)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = test.domain.com)(PORT = 1521))
    )
  )

  2). listener start

[oracle@test admin]$ lsnrctl start

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:24:29

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Starting /u01/app/oracle/product/10.2.0/db_1/bin/tnslsnr: please wait...

TNSLSNR for Linux: Version 10.2.0.4.0 - Production
System parameter file is /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Log messages written to /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ghjang.domain.com)(PORT=1521)))

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ghjang.domain.com)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 - Production
Start Date                07-JUL-2010 16:24:29
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File         /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=test.domain.com)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully

  3). listener status 확인

[oracle@test admin]$ lsnrctl status

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:25:28

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 - Production
Start Date                07-JUL-2010 16:24:29
Uptime                    0 days 0 hr. 0 min. 58 sec
Trace Level               off
Security                  ON: Local OS Authentication
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File         /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=test.domain.com)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "test" has 1 instance(s).
  Instance "test", status READY, has 1 handler(s) for this service...
Service "testXDB" has 1 instance(s).
  Instance "test", status READY, has 1 handler(s) for this service...
The command completed successfully

  4). listener stop

[oracle@test admin]$ lsnrctl stop

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:26:26

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
The command completed successfully

2. 패스워드 설정
  1). listener.ora 파일 확인

# listener.ora Network Configuration File: /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
# Generated by Oracle configuration tools.

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = PLSExtProc)
      (ORACLE_HOME = /u01/app/oracle/product/10.2.0/db_1)
      (PROGRAM = extproc)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = test.domain.com)(PORT = 1521))
    )
  )

  2). set password

리스너에 패스워드를 걸기 위해서는 listener.ora파일에
LOCAL_OS_AUTHENTICATION_LISTENER 파라미터가 OFF로 설정이 되어 있어야 한다.

os] vi $ORACLE_HOME/network/admin/listener.ora

# listener.ora Network Configuration File: /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
# Generated by Oracle configuration tools.

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = PLSExtProc)
      (ORACLE_HOME = /u01/app/oracle/product/10.2.0/db_1)
      (PROGRAM = extproc)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = test.domain.com)(PORT = 1521))
    )
  )

LOCAL_OS_AUTHENTICATION_LISTENER = OFF

그리고 listener를 start시킨다. 패스워드를 설정하기 위해서는 listener 프로세스가 실행되어 있어야 한다.

[oracle@test admin]$ lsnrctl

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:35:40

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> start
Starting /u01/app/oracle/product/10.2.0/db_1/bin/tnslsnr: please wait...

TNSLSNR for Linux: Version 10.2.0.4.0 - Production
System parameter file is /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Log messages written to /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=test.domain.com)(PORT=1521)))

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 - Production
Start Date                07-JUL-2010 16:35:41
Uptime                    0 days 0 hr. 0 min. 0 sec
Trace Level               off
Security                  OFF                         => 패스워드 설정이 안되어 있는 것을 알 수 있다.
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File         /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=test.domain.com)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully

패스워드를 설정한다.
처음 설정할 경우 old password는 입력하지 않아도 되고, 마지막에는 꼭 save_config 명령을 실행하여
패스워드를 저장하도록 한다.
만약 save_config를 하지 않을 경우 패스워드가 등록되지 않는다.

[oracle@test admin]$ lsnrctl

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:39:24

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully

  4). listener.ora 파일 확인

# listener.ora Network Configuration File: /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
# Generated by Oracle configuration tools.

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = PLSExtProc)
      (ORACLE_HOME = /u01/app/oracle/product/10.2.0/db_1)
      (PROGRAM = extproc)
    )
  )

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = ghjang.domain.com)(PORT = 1521))
    )
  )

LOCAL_OS_AUTHENTICATION_LISTENER = OFF

#----ADDED BY TNSLSNR 07-JUL-2010 16:50:34---
PASSWORDS_LISTENER = 12BC9D5D72FD1F01                        => 암호화된 패스워드가 설정되었다.
#--------------------------------------------

  5). listener status 확인

[oracle@test admin]$ lsnrctl status

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:51:47

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
TNS-01169: The listener has not recognized the password    => 패스워드가 설정되어 확인할 수 없다는 메시지가 나온다.

확인하기 위해서는 패스워드를 입력해야 한다. 패스워드를 입력하는 방법은 아래와 같다.

[oracle@test admin]$ lsnrctl

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:54:24

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias                     LISTENER
Version                   TNSLSNR for Linux: Version 10.2.0.4.0 - Production
Start Date                07-JUL-2010 16:49:44
Uptime                    0 days 0 hr. 4 min. 49 sec
Trace Level               off
Security                  ON: Password       => 패스워드가 설정되어있음을 확인할 수 있다.
SNMP                      OFF
Listener Parameter File   /u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File         /u01/app/oracle/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
  (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=test.domain.com)(PORT=1521)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
  Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "test" has 1 instance(s).
  Instance "test", status READY, has 1 handler(s) for this service...
Service "testXDB" has 1 instance(s).
  Instance "test", status READY, has 1 handler(s) for this service...
The command completed successfully

  6). listener stop

[oracle@test admin]$ lsnrctl stop

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:52:32

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
TNS-01169: The listener has not recognized the password     => 패스워드가 설정되어 확인할 수 없다는 메시지가 나온다.

리스너를 stop 시키기 위해서는 패스워드를 입력해야 한다. 아래와 같다.

 [oracle@test admin]$ lsnrctl

LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 07-JUL-2010 16:55:54

Copyright (c) 1991, 2007, Oracle.  All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=test.domain.com)(PORT=1521)))
The command completed successfully