Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Install listener as different user
        
(Message started by: Pete Finnigan on Jun 13^th, 2006, 6:17pm)

Title: Install listener as different user
Post by Pete Finnigan on Jun 13^th, 2006, 6:17pm

Hi All,

I've seen a checklist prepared by peteF where he states create different user accounts for different pieces of oracle software.

I can see how apache can be installed as different from oracle owner but not the listener. can anyone outline how it can be done. I really appreciate it.

Is this still necessary in 10g with local authentication, password protected and admin_restrictions_listener=on?

Thanks,
Stalin

PS I'm eagerly waiting to read pete's step by step book. It's been in amazon order for almost 15days :(

Title: Re: Install listener as different user
Post by Pete Finnigan on Jun 13^th, 2006, 8:50pm

Hi,

You dont need to install the listener as a seperate user, just run it as a different user. Its well documented in a number of Oracle advisories, for instance Alert #29. The example there is for extproc but you can simply run the main listener as another user.

The reason for doing it is because if a hacker is able to expliot the listener and gain access to the OS then he will not be able to access the rest of the Oracle installation.

It is definately necessary still for 10g as its still possible that a 10g listener can be exploited. The local authentication in 10g can be easily bypassed as well.

hth

cheers

Pete

Title: Re: Install listener as different user
Post by Pete Finnigan on Jun 14^th, 2006, 1:02am

Ah run listener as different user from the oracle software owner. Got it.

I tried running lsnrctl from nobody unix user after chowning listener.ora to 601. Then i realized the issue with log/traces files that listener might generate would end up in permission denied error.

This make me to ask another question, is it possible to install oracle on mount point and then remount it as readonly. Assuming dbs,admin,oradata dirs on a shared writeable drive. there are other dirs that oracle might require write permission but wondering is it even worth taking that route.

Thanks Pete. I really appreicate it.

Title: Re: Install listener as different user
Post by Pete Finnigan on Jun 14^th, 2006, 1:19am

Never mind about the listener logging on default directory. I can make the logs/trace file to get logged elsewhere with log_directory and trc_directory respectively.

if you could give your suggestions on the readonly mounts that would be great.

thanks once again.
Stalin