Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> listener.ora password
        
(Message started by: Pete Finnigan on Feb 8^th, 2006, 5:01pm)

Title: listener.ora password
Post by Pete Finnigan on Feb 8^th, 2006, 5:01pm

Hi, after a recent IT audit we've been told to set up a listener password for our Oracle 9R2 database on VMS. I tried following Petes tip on his website but got a few error messages when entering the save_config command e.g
TNS-12570
TNS-12560
TNS-00530

It turns out that we use something called host naming to connect to our database, meaning that although we have a listener.ora file it contains only a blank line. I suspect this is why the pasword saving is not working. Can anyone shed any light?

Title: Re: listener.ora password
Post by Pete Finnigan on Mar 4^th, 2006, 9:33am

With or without onames your listener remain vulnerable on direct (ip based not named machines) attacks.

So pass protection must be used as it reduce probability of success - but you must know that on 9 releases this is far (away) from beeing 100% effective ...Last (10) releases help more using local OS autentification to gain listener access and this is a bit better...(more limitative less probability to get broken).
As for your config ... you are using a remote listener.. Check your startup parameter file and tnsnames for details (real remote listener location).