近日安全部门在对系统进行安全扫描检查时，报出有几套库的监听LISTENER的口令没有设置的警告信息，大部分系统的监听口令都是被设置的，仅有少量的几套9I和10G的监听没有配置口令，既然要做这项工作，就先做个测试，也与大家分享下。
在10G版本上的测试：
[oracle@ligle-db
admin]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 12-APR-2011 12:49:20
Copyright (c) 1991, 2007, Oracle. All
rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener LIGLEWANG_LSNR -
- >设置为当前监听
Current Listener is LIGLEWANG_LSNR
LSNRCTL> change_password -
- >改变密码
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
Password changed for LIGLEWANG_LSNR
The command completed successfully
LSNRCTL> save_config -
- >保存配置
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
Saved LIGLEWANG_LSNR configuration parameters.
Listener Parameter File
/u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Old Parameter File
/u01/app/oracle/product/10.2.0/db_1/network/admin/listener.bak
The command completed successfully
LSNRCTL> status -
- >查询监听状态
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
STATUS of the LISTENER
------------------------
Alias LIGLEWANG_LSNR
Version TNSLSNR for
Linux: Version 10.2.0.4.0 – Production
Start Date 12-APR-2011
12:46:46
Uptime 0 days 0 hr. 3
min. 44 sec
Trace Level off
Security ON: Password or Local OS
Authentication
SNMP OFF
Listener Parameter File
/u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File
u01/app/oracle/product/10.2.0/db_1/network/log/liglewang_lsnr.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ligle-db)(PORT=8000)))
The listener supports no services
The command completed successfully
在status命令的输出中，可以看到有这样一行：
Security ON: Password or Local OS Authentication
该行表示使用本地操作系统认证，这种认证方式在我们对监听进行维护时是不需要输入口令的，这也是跟9i的一个小差别。当然也不是任何登录到OS中的用户都可以对LISTENER进行维护的，比如系统中存在ligle这样的一个用户：
[ligle@ligle-db
~]$ id - - >当前OS用户为ligle
uid=503(ligle) gid=501(oinstall) groups=501(oinstall),502(dba)
[ligle@ligle-db ~]$ lsnrctl
LSNRCTL for Linux: Version 10.2.0.4.0 - Production on 12-APR-2011 13:16:17
Copyright (c) 1991, 2007, Oracle. All
rights reserved.
Welcome to LSNRCTL, type "help" for information.
LSNRCTL> set current_listener LIGLEWANG_LSNR -
- >设置为当前监听
Current Listener is LIGLEWANG_LSNR
LSNRCTL> status -
- >查看监听状态（此操作没问题）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
STATUS of the LISTENER
------------------------
Alias LIGLEWANG_LSNR
Version TNSLSNR for
Linux: Version 10.2.0.4.0 – Production
Start Date 12-APR-2011
12:46:46
Uptime 0 days 0 hr. 29
min. 44 sec
Trace Level off
Security ON: Password or
Local OS Authentication
SNMP OFF
Listener Parameter File
/u01/app/oracle/product/10.2.0/db_1/network/admin/listener.ora
Listener Log File
u01/app/oracle/product/10.2.0/db_1/network/log/liglewang_lsnr.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=ligle-db)(PORT=8000)))
The listener supports no services
The command completed successfully
LSNRCTL> stop -
- >停止监听（报错）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
TNS-01190: The
user is not authorized to execute the requested listener command
LSNRCTL> set password -
- >输入密码
Password:
The command completed successfully
LSNRCTL> stop -
- >停止监听（正常）
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ligle-db)(PORT=8000)))
The command completed successfully
可以看到OS用户ligle在对stop监听的时候，报TNS-01190错误，这是因为该用户没有输入监听口令所致；在通过set password设置口令之后，方可对监听执行维护操作。
Bset Regards
2011.11.05
--The End—
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/25834554/viewspace-710259/ ，如需转载，请注明出处，否则将追究法律责任。
