Oracle数据库安全往往容易被SA或者DBA所忽视，实则还是需要提高警惕，一下是一些配置和参数以改进Oracle数据库的安全性。
0. 限制sysdba角色的用户使用远程登录
alter system set remote_login_passwordfile=none scope=spfile;
这个参数默认值为 EXCLUSIVE ，注意，修改后只能从主机上使用OS认证的方式进行登录。
1. 使用profile进行限定资源和口令安全
如果要使用口令管理，以SYS执行 utlpwdmg.sql 脚本。
@?/rdbms/admin/utlpwdmg.sql;
口令帐户锁定相关参数：
FAILED_LOGIN_ATTEMPTS 锁允许登录失败的次数
PASSWORD_LOCK_TIME 达到登录失败次数后，帐户锁定的天数，过了这个天数之后帐户会自动解锁
口令失效和过期相关参数：
PASSWORD_LIFE_TIME 口令的生存期（天）
PASSWORD_GRACE_TIME 口令失效后从第一次成功登录算起的更改口令的宽限期（天）
口令历史记录相关参数：
PASSWORD_REUSE_TIME 可以重新使用口令前的天数
PASSWORD_REUSE_MAX 可以重新使用口令的最多次数
口令校验相关参数：
PASSWORD_VERIFY_FUNCTION 检验口令设置的PL/SQL 函数
如何使用这些参数呢？一是创建新的配置文件，然后把配置文件绑定到用户：
CREATE PROFILE profile_name LIMIT
FAILED_LOGIN_ATTEMPTS 6
PASSWORD_VERIFY_FUNCTION verify_function
PASSWORD_LOCK_TIME 1/24;
ALTER USER user_name PROFILE profile_name;
如果不需要配置文件了，删除：
DROP PROFILE developer_prof CASCADE
二是直接修改默认的配置文件，这样对每个使用该配置文件的用户都是生效的：
ALTER PROFILE DEFAULT LIMIT
FAILED_LOGIN_ATTEMPTS 6
PASSWORD_VERIFY_FUNCTION verify_function
PASSWORD_LOCK_TIME 1/24;
2. 设置监听器口令
在10g当中，监听器的口令设置已经过时了，对监听器的任何操作默认情况下变成了OS认证方式，也就是说对监听启动操作的用户可以任意停止监听，而非启动用户则无法对监听器进行停止，但是如果你想要恢复到9i的那种需要口令操作的情况，可以如下设置：
listener.ora文件增加如下一行参数：
LOCAL_OS_AUTHENTICATION_[listener name] = OFF
通过以下方式设置口令：
[oracle@test admin]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:42:03
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
LSNRCTL> save_config --奇怪的是保存失败，需要执行下 set password之后重新保存即可
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
LSNRCTL>
接下来测试下结果，当然要重启下linstener。
[oracle@test admin]$ lsnrctl stop
LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:39:39
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
TNS-01169: The listener has not recognized the password
[oracle@test admin]$ lsnrctl status
LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:39:48
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
TNS-01169: The listener has not recognized the password
可以看到上面的stop和status操作都失败了，如下操作是成功的：
[oracle@test admin]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 08-AUG-2012 14:40:00
Copyright (c) 1991, 2010, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> set password
Password:
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
The command completed successfully
LSNRCTL> start
Starting /u01/oracle/10g/product/10.2.0/db_1/bin/tnslsnr: please wait...
TNSLSNR for Linux: Version 10.2.0.5.0 - Production
System parameter file is /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora
Log messages written to /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 10.2.0.5.0 - Production
Start Date 08-AUG-2012 14:40:33
Uptime 0 days 0 hr. 0 min. 0 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "gt10g" has 1 instance(s).
Instance "gt10g", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.2.4)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 10.2.0.5.0 - Production
Start Date 08-AUG-2012 14:40:33
Uptime 0 days 0 hr. 0 min. 2 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /u01/oracle/10g/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File /u01/oracle/10g/product/10.2.0/db_1/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.2.4)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC0)))
Services Summary...
Service "PLSExtProc" has 1 instance(s).
Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
Service "gt10g" has 2 instance(s).
Instance "gt10g", status UNKNOWN, has 1 handler(s) for this service...
Instance "gt10g", status READY, has 1 handler(s) for this service...
Service "gt10gXDB" has 1 instance(s).
Instance "gt10g", status READY, has 1 handler(s) for this service...
Service "gt10g_XPT" has 1 instance(s).
Instance "gt10g", status READY, has 1 handler(s) for this service...
The command completed successfully
3. 设置连接IP限制
通过修改sqlnet.ora配置文件，以限制来源IP是否可以访问数据库：
tcp.validnode_checking = yes
tcp.invited_nodes = (localhost,ip1,ip2)
注意，一定要把本机的地址添加进去，否则连数据库本机都无法注册到监听。
阅读(1647) | 评论(0) | 转发(0) |
