encrypted listener password

There a few major changes in the database administration and the database security between 9i and 10g.

In 9i, I used to grep in the listener.ora to find out the password.

LISTENER_LSC61 =
(DESCRIPTION=(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10061)(QUEUESIZE=200))
))
PASSWORDS_LISTENER_LSC61 = 1234567890ABCDEF

this 64bit encrypted string can be used in 9i to stop the listener

$ lsnrctl

LSNRCTL for IBM/AIX RISC System/6000: Version 9.2.0.6.0 – Production on 05-DEC-2005 14:33:51

Copyright (c) 1991, 2002, Oracle Corporation. All rights reserved.

Welcome to LSNRCTL, type “help” for information.

LSNRCTL> set current_listener listener_lsc61
Current Listener is listener_lsc61
LSNRCTL> set password 1234567890ABCDEF
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10061)(QUEUESIZE=200)))
The command completed successfully

As a dba, it is quite handy, because you can use grep (or awk) to find out the password out of the listener.ora. As a security admin, you should make sure the listener.ora is not readable. Note that the default, when created by netmgr, is to be world-readable :-(

However, this does no longer work in 10g

LISTENER_LSC62 =
(DESCRIPTION=(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10062)(QUEUESIZE=200))
))

PASSWORDS_listener_LSC62 = 1234567890ABCDEF

the encrypted string can no longer be used

$ lsnrctl

LSNRCTL for IBM/AIX RISC System/6000: Version 10.1.0.4.0 – Production on 05-DEC-2005 14:37:24

Copyright (c) 1991, 2004, Oracle. All rights reserved.

Welcome to LSNRCTL, type “help” for information.

LSNRCTL> set current_listener listener_lsc62
Current Listener is listener_lsc62
LSNRCTL> set password 1234567890ABCDEF
The command completed successfully
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10062)(QUEUESIZE=200)))
TNS-01169: The listener has not recognized the password
TNS-01189: The listener could not authenticate the user

As a security admin, you would think it is better so. But, how are you going to stop the listener in your script? Well, in 10g, we can use local authentification (default). So if the script is started as oracle, we would not need to use password

LISTENER_LSC63 =
(DESCRIPTION=(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10016)(QUEUESIZE=200))
))

PASSWORDS_listener_LSC63 = 1234567890ABCDEF

$ whoami
oracle
$ hostname
dbsrv85a.ex.zkb.ch
$ lsnrctl

LSNRCTL for IBM/AIX RISC System/6000: Version 10.2.0.1.0 – Production on 05-DEC-2005 14:43:33

Copyright (c) 1991, 2005, Oracle. All rights reserved.

Welcome to LSNRCTL, type “help” for information.

LSNRCTL> set current_listener LISTENER_LSC63
Current Listener is LISTENER_LSC63
LSNRCTL> stop
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=dbsrv85a.ex.zkb.ch)(PORT=10016)(QUEUESIZE=200)))
The command completed successfully

I read in an Alex Kornbrust post on Pete Finnigan forum, that a LOCAL_OS_AUTHENTICATION “undocumented” parameter could be used to “avoid” local authentication, but in that case, it is going to be a nightmare to “stop” the listener in an automated script, well, we can still use “kill”, but it is not very beautifoul.

Published by

Laurent Schneider

Oracle Certified Master

6 thoughts on “encrypted listener password”

  1. Laurent,

    Alexander found out that local os authentication can be circumvented and therefore his advice is to use and strong listener password and to disable local os authentication.
    I suppose his advise is until Oracle solves this bug. And yes, I think killing the listener in automated script is the second best option in this case.

    Ivan

  2. Thanks for those tips, were very helpful for a 9i build I just did. For info, the system startup/shutdown shell script I used is pasted below. The location of the listener.ora file was /etc in my case, but that can be different in other servers. The script assumes oracle environment variables are all set correctly at login (the “su -“).

    For this script to actually run at system startup/shutdown time, it needs to be linked into the /etc/rc*.d directories, at least /etc/rc3.d (the default startup/shutdown level) although I put it in the others also.
    That is, as root user:
    vi /etc/init.d/oracle
    [pasted in the below shell script]
    chmod 755 /etc/init.d/oracle
    cd /etc/rc1.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle
    cd /etc/rc2.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle
    cd /etc/rc3.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle
    cd /etc/rc4.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle
    cd /etc/rc5.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle
    cd /etc/rc6.d
    ln -s ../init.d/oracle K99oracle
    ln -s ../init.d/oracle S99oracle

    [ Script itself:]

    #!/bin/sh
    #
    #Start/Stop script for oracle
    #

    case “$1″ in

    ‘start’)
    su – oracle

  3. to start you do not need a listener

    to stop, you can use
    PW=$(grep -i passwords_listener $TNS_ADMIN/listener.ora | cut -d= -f2)
    lsnrct < set password $PW
    stop
    eof

    in 9i and below

Leave a Reply

Your email address will not be published.


*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>