标签：LSNRCTL listener 密码 xx ADDRESS Oracle password 监听

Oracle 监听是外部应用程序连接oracle的入口，用oracle提供的lsnrctl 进行管理。默认监听在端口1521上的tnslsnr未设置密码保护，这可能是个安全隐患，也可能会被远程发起监听器的管理，导致数据库被入侵。

更改监听密码
如果之前没有，默认为空
[oracle@test152 ~]$ lsnrctl

LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 03-Jun-2020 10:54:45

Copyright (c) 1991, 2013, Oracle. All rights reserved.

Welcome to LSNRCTL, type "help" for information.
LSNRCTL> help
The following operations are available
An asterisk (*) denotes a modifier or extended command:

start stop status
services version reload
save_config trace spawn
change_password quit exit
set* show*

LSNRCTL> change_password
#之前没设置密码直接回车
Old password:
#输入新的密码
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.xx.xx)(PORT=1521)))
Password changed for LISTENER
The command completed successfully
#此时保存是失败的
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.xx.xx)(PORT=1521)))
TNS-01169: The listener has not recognized the password
#需要重新验证下
LSNRCTL> set password
Password:
The command completed successfully
#这时保存才算成功，save_config 需要执行两次
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.xx.xx)(PORT=1521)))
Saved LISTENER configuration parameters.
Listener Parameter File /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.ora
Old Parameter File /u01/app/oracle/product/11.2.0/dbhome_1/network/admin/listener.bak
The command completed successfully

说明1：Oracle 11g在listener加密的情况下，在本服务器上执行 lsnrctl status listener_name 仍然可以执行，除非listener.ora里加如下内容 LOCAL_OS_AUTHENTICATION_LISTENER = OFF，默认是ON

说明2：配置listener.ora中ADMIN_RESTRICTIONS参数，一般不加
参数作用：
当listener.ora设置了ADMIN_RESTRICTIONS参数后，在监听器运行时不允许执行任何管理命令，同时set命令将不可用，不论在服务器本地还是从远程都不行。此时对于监听的设置仅仅通过手工修改listener.ora文件，要使修改生效，只能使用lsnrctl reload命令或lsnrctl stop/start命令重新载入一次监听器配置信息。
修改方法：
在listener.ora文件中手动加入下面这样一行 ADMIN_RESTRICTIONS_<监听器名> = ON

设置监听密码
LSNRCTL> set password
Password:
The command completed successfully
设置完成之后需要保存生效,重要
LSNRCTL> save_config
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
Saved LISTENER configuration parameters.

监听文件最后会新增一行
[oracle@test152 ]$ cat listener.ora
...
#前面新增的
LOCAL_OS_AUTHENTICATION_LISTENER = OFF

#----ADDED BY TNSLSNR 04-3月 -2020 16:23:16---
PASSWORDS_LISTENER = C7AD988BC0D7DB0A
#----------------------------------------------

查询监听状态
不输入密码无法查询或关启监听
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.xx.xx)(PORT=1521)))
TNS-01169: The listener has not recognized the password
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.xx.xx)(PORT=1521)))
TNS-01169: The listener has not recognized the password

#输入上面设置的密码
LSNRCTL> set password
#输入密码
Password:
The command completed successfully
#此时可以正常查询监听状态，也可以关启监听
LSNRCTL> status
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for Linux: Version 11.2.0.4.0 - Production
Start Date 03-Jun-2020 15:37:09
Uptime 439 days 3 hr. 18 min. 4 sec
Trace Level off
Security ON: Password
SNMP OFF
Listener Parameter File /u01/app/oracle/product/11.2.0/db_home1/network/admin/listener.ora
Listener Log File /u01/app/oracle/diag/tnslsnr/test152 /listener/alert/log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.xx.xx)(PORT=1521)))
Services Summary...
Service "testdb" has 1 instance(s).
Instance "testdb", status READY, has 1 handler(s) for this service...
Service "testdb1" has 1 instance(s).
.
.
.
Instance "testdbdg1", status UNKNOWN, has 1 handler(s) for this service...
The command completed successfully
LSNRCTL>

如何回退？

A、记得原来监听密码
[oracle@test152 ~]$ lsnrctl
LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 03-Jun-2020 10:54:45
Copyright (c) 1991, 2013, Oracle. All rights reserved.
Welcome to LSNRCTL, type "help" for information.

LSNRCTL> change_password
Old password:
New password:
Reenter new password:
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
Password changed for LISTENER
The command completed successfully

B、不记得原密码
1、ps -ef|grep lsnr 查询当前监听程序的sid
2、kill 该进程
3、进入$ORACLE_HOME/network/admin目录，打开listener.ora文件，在下面有一行关于密码的加密的记录前面加上#，注释该行。注意：修改前，先备份。
4、再次启动监听，此时不再需要密码了

标签：LSNRCTL,listener,密码,xx,ADDRESS,Oracle,password,监听
来源： https://www.cnblogs.com/ritchy/p/14485472.html

本站声明： 1. iCode9 技术分享网（下文简称本站）提供的所有内容，仅供技术学习、探讨和分享；
2. 关于本站的所有留言、评论、转载及引用，纯属内容发起人的个人观点，与本站观点和立场无关；
3. 关于本站的所有言论和文字，纯属内容发起人的个人观点，与本站观点和立场无关；
4. 本站文章均是网友提供，不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属；如您发现该文章侵犯了您的权益，可联系我们第一时间进行删除；
5. 本站为非盈利性的个人网站，所有内容不会用来进行牟利，也不会利用任何形式的广告来间接获益，纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。