一 说明

Oracle Database Server 在实现上存在可允许攻击者向远程“TNS Listener”组件处理的数据投毒的漏洞。攻击者可利用此漏洞将数据库服务器的合法“TNS Listener”组件中的数据转向到攻击者控制的系统，导致控制远程组件的数据库实例，造成组件和合法数据库之间的攻击者攻击、会话劫持或拒绝服务攻击。现以限制监听注册的方法来阻止该监听投毒漏洞。

注意，该文档适用于 10.2.0.3 to 11.2.0.3 版本的单机或者rac数据库。

如果是11204的数据库，可以参考 文档 ID 1600630.1，参考文档最下方

二 前期准备工作

关键补丁检查

存在该补丁12880299。

创建wallet 用户

节点 1 Oracle 用户下：

mkdir /oracle/grid/crs_1/network/admin/cost

$ orapki wallet create -wallet /oracle/grid/crs_1/network/admin/cost

Oracle PKI Tool : Version 11.2.0.3.0 - Production

Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved.

Enter password:          

Enter password again:

密码设置为uni09net

 orapki wallet remove -trusted_cert_all -wallet /oracle/grid/crs_1/network/admin/cost

（该步骤可忽略，目的是删除cost 里面的所有内容）

将节点1 加到wallet 里去

orapki wallet add -wallet /oracle/grid/crs_1/network/admin/cost -self_signed -dn "cn=secure_register" -keysize 1024 -validity 3650

$ orapki wallet add -wallet /oracle/grid/crs_1/network/admin/cost -self_signed -dn "cn=secure_register" -keysize 1024 -validity 3650

Oracle PKI Tool : Version 11.2.0.3.0 - Production

Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:  

PKI-02003: Unable to load the wallet at: /oracle/grid/crs_1/network/admin/cost

[oracle@apple1 ~]$ orapki wallet add -wallet /oracle/grid/crs_1/network/admin/cost -self_signed -dn "cn=secure_register" -keysize 1024 -validity 3650

Oracle PKI Tool : Version 11.2.0.3.0 - Production

Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:

展示cost内的内容：

orapki wallet display -wallet /oracle/grid/crs_1/network/admin/cost -summary

$ orapki wallet display -wallet /oracle/grid/crs_1/network/admin/cost -summary

Oracle PKI Tool : Version 11.2.0.3.0 - Production

Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:          

Requested Certificates:

User Certificates:

Subject:        CN=secure_register

Trusted Certificates:

Subject:        CN=secure_register

将cost 文件复制到二节点 oracle 用户下( 提前创建好目录）

scp /oracle/grid/crs_1/network/admin/cost/ewallet.p12 apple2:/oracle/grid/crs_1/network/admin/cost

2.5 oracle 用户下，两节点创建sso 文件

orapki wallet create -wallet /oracle/grid/crs_1/network/admin/cost -auto_login

$ orapki wallet create -wallet /oracle/grid/crs_1/network/admin/cost -auto_login

Oracle PKI Tool : Version 11.2.0.3.0 - Production

Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:          

权限修改

chmod 640 cwallet.sso

-rw-r-----. 1 oracle oinstall 2485 Aug  2 09:09 cwallet.sso

-rw-------. 1 oracle oinstall 2408 Aug  2 09:07 ewallet.p12

三 修改listener.ora, 添加一下内容

注意， 所有节点， GI_HOME 的 listener.ora

WALLET_LOCATION =

  (SOURCE =

   (METHOD = FILE)

    (METHOD_DATA =

     (DIRECTORY = /oracle/grid/crs_1/network/admin/cost)

    )

  )

#SECURE_REGISTER_LISTENER_SCAN1 = (IPC,TCPS)

#### 一个scan就写一个，多个就继续添加如下

#SECURE_REGISTER_LISTENER_SCAN2 = (IPC,TCPS)

#SECURE_REGISTER_LISTENER_SCAN3 = (IPC,TCPS)

配置scan_listener

$ srvctl config scan_listener

SCAN Listener LISTENER_SCAN1 exists. Port: TCP:1521

srvctl modify scan_listener -p TCP:1521/TCPS:1523  (grid 用户下）

srvctl stop scan_listener

srvctl start scan_listener

srvctl config scan_listener

SCAN Listener LISTENER_SCAN1 exists. Port: TCP:1521/TCPS:1523

修改sqlnet.ora 文件

两节点的Oracle 用户下：

vi $ORACLE_HOME/network/admin/sqlnet.ora  ## 没有该文件直接创建

添加一下信息：

WALLET_LOCATION =

  (SOURCE =

   (METHOD = FILE)

    (METHOD_DATA =

     (DIRECTORY = /oracle/grid/crs_1/network/admin/cost))

    )

  )

  添加完之后，两节点数据库重启

修改remote_listener 参数

原来的：

SQL> show parameter remote_listener  

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

remote_listener                      string      apple-scan:1521

修改后

alter system set remote_listener='(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCPS)(HOST=192.168.240.195)(PORT=1523)))' scope=both sid='*';

SQL> show parameter remote

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

remote_dependencies_mode             string      TIMESTAMP

remote_listener                      string      (ADDRESS_LIST=(ADDRESS=(PROTOC

                                                 OL=TCPS)(HOST=192.168.240.195)

                                                 (PORT=1523)))

2.5 

将两个节点grid下面的listener.ora中的注释删掉并重启scan监听

#SECURE_REGISTER_LISTENER_SCAN1 = (IPC,TCPS) 

[oracle@rac1]$ srvctl stop scan_listener

[oracle@rac1]$ srvctl start scan_listener   

测试成果

测试1 ：将其他rac库的remote listener参数改成如下，192.168.240.195为scan ip

alter system set remote_listener ='192.168.240.195:1521';

可以看到日志中如下，说明阻止了其他rac注册到监听中

Tue Jul 31 13:12:45 2018

31-JUL-2018 13:12:45 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=apple2)(USER=grid))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER_SCAN1)(VERSION=186647296)) * status * 0

Tue Jul 31 13:13:45 2018

31-JUL-2018 13:13:45 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=apple2)(USER=grid))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER_SCAN1)(VERSION=186647296)) * status * 0

Tue Jul 31 13:14:39 2018

31-JUL-2018 13:14:39 * service_register_NSGR * 1194

TNS-01194: The listener command did not arrive in a secure transport

31-JUL-2018 13:14:39 * service_register_NSGR * 1194

TNS-01194: The listener command did not arrive in a secure transport  

测试2：                          

C:\Users\think>sqlplus system/oracle@192.168.240.195:1521/prod

SQL*Plus: Release 11.2.0.4.0 Production on 星期二 7月 31 13:32:14 2018

Copyright (c) 1982, 2013, Oracle.  All rights reserved.

连接到:

Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production

With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP,

Data Mining and Real Application Testing options

SQL> exit

四、非 scan 监听配置

Add the COST TCP protocol restriction "SECURE_REGISTER_[listener_name] = (TCP)" to the listener.ora.

Match the COST parameter variable listener_name with the name of the listener you are using in the listener.ora, e.g.,  If your listener name is "LISTENER_PROD" then use SECURE_REGISTER_LISTENER_PROD = (TCP)

LISTENER_PROD =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = netfl-bde)(PORT = 1551))
    )
  )

SECURE_REGISTER_LISTENER_PROD = (TCP)   ## 这个是单机的         

 The database must be using the TCP protocol to register with the listener. Check the value of the startup parameter local_listener to confirm.

Important for grid installations: The grid agent uses the IPC protocol to contact and manage the listener so both IPC and TCP must be enabled in this step.

For a grid environment use the following value,  ### 下面这个是rac的监听

SECURE_REGISTER_LISTENER_PROD = (IPC,TCP)

五： 回退措施

1 alter system set remote_listener='apple-scan:1521' sid='*';

2 rm -rf /oracle/grid/crs_1/network/admin/cost 两节点

3 /oracle/grid/crs_1/network/admin/listener.ora 中添加的注释掉 两节点

4 $ORACLE_HOME/network/amdin/sqlnet.ora 中添加的东西注释掉 两节点数据库重启

5 grid 用户下配置scan_listener

srvctl modify scan_listener -p TCP:1521

srvctl stop scan_listener

srvctl start scan_listener

关于 11204 数据监听偷渡的修改，

VALID_NODE_CHECKING_REGISTRATION _listener_name
Values:
     OFF/0 - Disable VNCR
     ON/1/LOCAL - The default. Enable VNCR. All local machine IPs can register.
     SUBNET/2 - All machines in the subnet are allowed registration.

12c 默认是 ON，11204默认是off；

在listener.ora 将参数添加重启监听即可。

。。。。=ON