工作上有用到Listener加密的这个需求，试了试，留下个简单的记录，觉得在单实例数据库中还较方便的。

在RAC中由于用到srvctl 管理，在srvctl start ...　命令时会去检查Listener的status(这个动作就等同于是执行了lsnrctl status命令来查询Listener状态)，所以这个时候会不通过(这是我目前在RAC环境加密Listener测试到挺麻烦的一个issue)，有时间再查一查。

rac-test2$lsnrctl <<< 此时是没有设置密码前的操作，可以正常作业(如status/start/stop/reload等操作)

LSNRCTL for Linux: Version 9.2.0.8.0 - Production on 09-9??-2008 11:28:19

Copyright (c) 1991, 2006, Oracle Corporation. All rights reserved.

Welcome to LSNRCTL, type "help" for information.

LSNRCTL> status

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac-test2)(PORT=1521)))

STATUS of the LISTENER

------------------------

Alias LISTENER

Version TNSLSNR for Linux: Version 9.2.0.8.0 - Production

Start Date 09-9??-2008 10:59:13

Uptime 0 days 0 hr. 29 min. 10 sec

Trace Level off

Security OFF

SNMP OFF

Listener Parameter File /oracle/9208/network/admin/listener.ora

Listener Log File /oracle/9208/network/log/listener.log

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=rac-test2)(PORT=1521)))

Services Summary...

Service "PLSExtProc" has 1 instance(s).

Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...

Service "testdb" has 1 instance(s).

Instance "testdb2", status READY, has 2 handler(s) for this service...

Service "testdb2" has 1 instance(s).

Instance "testdb2", status UNKNOWN, has 1 handler(s) for this service...

The command completed successfully

LSNRCTL> change_password <<<用change_password命令更改密码，若之前没有敲定过密码则在old password处直接回车跳过，在new password及reenter new password处分别输入新密码。

Old password:

New password:

Reenter new password:

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac-test2)(PORT=1521)))

Password changed for LISTENER

The command completed successfully

LSNRCTL> status <<< 此时密码设定已经完毕，尝试一下status操作，收到报错提示：需要密码验证。

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac-test2)(PORT=1521)))

TNS-01169: The listener has not recognized the password

LSNRCTL> set password <<< 我们需要通过set password来验证密码，并输入之前设定的密码，验证通过方可执行相关操作。

Password:

The command completed successfully

LSNRCTL> status <<< 可以试一下在密码验证成功后的操作结果是成功的。

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac-test2)(PORT=1521)))

STATUS of the LISTENER

------------------------

Alias LISTENER

Version TNSLSNR for Linux: Version 9.2.0.8.0 - Production

Start Date 09-9??-2008 10:59:13

Uptime 0 days 0 hr. 29 min. 36 sec

Trace Level off

Security ON

SNMP OFF

Listener Parameter File /oracle/9208/network/admin/listener.ora

Listener Log File /oracle/9208/network/log/listener.log

Listening Endpoints Summary...

(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=rac-test2)(PORT=1521)))

Services Summary...

Service "PLSExtProc" has 1 instance(s).

Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...

Service "testdb" has 1 instance(s).

Instance "testdb2", status READY, has 2 handler(s) for this service...

Service "testdb2" has 1 instance(s).

Instance "testdb2", status UNKNOWN, has 1 handler(s) for this service...

The command completed successfully

LSNRCTL> save_config <<< 注意密码设定后一定要用save_config命令保存所做的设置，oracle会将这些设置的变动保留到listener.ora里面去。

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac-test2)(PORT=1521)))

Saved LISTENER configuration parameters.

Listener Parameter File /oracle/9208/network/admin/listener.ora

Old Parameter File /oracle/9208/network/admin/listener.bak

The command completed successfully

LSNRCTL>

在设定了密码以及保存了设置后Listener.ora里会出现这样一条记录：

#----ADDED BY TNSLSNR 09-9??-2008 11:28:52---

PASSWORDS_LISTENER = 62753F69B85AD170

#----------------------------------------------

所以，大家需要注意的是，以后重启DB后，启动Listener时需要先进入lsnrctl 命令里通过 set password命令先输入密码方可进行操作哦！

PS：Listener做密码设定不会影响任何client 端的东西，仅是为了防止listener遭到远程恶意作业时加的一阵密码验证过程。