Auditing an Oracle database for security issues is very important. PeteFinnigan.com provides all of the information and tools that you will need Click here for details of PeteFinnigan.com Limited's detailed Oracle database security audit service Click here for details of PeteFinnigan.com Limited's Oracle Security Training Courses
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Welcome, Guest. Please Login.
Oct 25th, 2020, 4:44am
News: Welcome to Pete Finnigan's Oracle security forum
Home | Help | Search | Members | Login
   Pete Finnigan's Oracle Security Forum
   Oracle Security
   Oracle Security
(Moderator: Pete Finnigan)
   Install listener as different user
« Previous topic | Next topic »
Pages: 1  Reply | Notify of replies | Send Topic | Print
   Author  Topic: Install listener as different user  (Read 7830 times)
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Install listener as different user
« on: Jun 13th, 2006, 6:17pm »
Quote | Modify

Hi All,
 
I've seen a checklist prepared by peteF where he states create different user accounts for different pieces of oracle software.
 
I can see how apache can be installed as different from oracle owner but not the listener.  can anyone outline how it can be done.  I really appreciate it.  
 
Is this still necessary in 10g with local authentication, password protected and admin_restrictions_listener=on?
 
Thanks,
Stalin
 
PS I'm eagerly waiting to read pete's step by step book. It's been in amazon order for almost 15days Sad
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Install listener as different user
« Reply #1 on: Jun 13th, 2006, 8:50pm »
Quote | Modify

Hi,
 
You dont need to install the listener as a seperate user, just run it as a different user. Its well documented in a number of Oracle advisories, for instance Alert #29. The example there is for extproc but you can simply run the main listener as another user.  
 
The reason for doing it is because if a hacker is able to expliot the listener and gain access to the OS then he will not be able to access the rest of the Oracle installation.
 
It is definately necessary still for 10g as its still possible that a 10g listener can be exploited. The local authentication in 10g can be easily bypassed as well.
 
hth
 
cheers
 
Pete
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Install listener as different user
« Reply #2 on: Jun 14th, 2006, 1:02am »
Quote | Modify

Ah run listener as different user from the oracle software owner. Got it.
 
I tried running lsnrctl from nobody unix user after chowning listener.ora to 601. Then i realized the issue with log/traces files that listener might generate would end up in permission denied error.
 
This make me to ask another question, is it possible to install oracle on mount point and then remount it as readonly. Assuming dbs,admin,oradata dirs on a shared writeable drive. there are other dirs that oracle might require write permission but wondering is it even worth taking that route.
 
Thanks Pete. I really appreicate it.
 
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pete Finnigan
PeteFinnigan.com Administrator
*****




Oracle Security is easier if you design for it

   
View Profile | WWW | Email

Gender: male
Posts: 309
Re: Install listener as different user
« Reply #3 on: Jun 14th, 2006, 1:19am »
Quote | Modify

Never mind about the listener logging on default directory. I can make the logs/trace file to get logged elsewhere with log_directory and trc_directory respectively.
 
if you could give your suggestions on the readonly mounts that would be great.
 
thanks once again.
Stalin  
IP Logged

Pete Finnigan (email:pete@petefinnigan.com)
Oracle Security Web site: http://www.petefinnigan.com
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Pages: 1  Reply | Notify of replies | Send Topic | Print

« Previous topic | Next topic »

Powered by YaBB 1 Gold - SP 1.4!
Forum software copyright 2000-2004 Yet another Bulletin Board