ORACLE ORAchk. Using Class of Secure Transport (COST) to Restrict Instance Registration (ÿÿ ID ) APPLIES TO: GOAL

Transcription

1 版权所有 (C) 2018, Oracleÿ 保留所有权利 Using Class of Secure Transport (COST) to Restrict Instance Registration (ÿÿ ID ) In this Document Goal Solution References APPLIES TO: Oracle Database - Enterprise Edition - Version to [Release 10.2 to 11.2] Oracle Net Services - Version to [Release 10.2 to 11.2] Information in this document applies to any platform. GOAL ORACLE ORAchk In addition to this note, also take a look at proactive Database Healthchecks provided by ORACHK Find out more To demonstrate how the COST parameter "SECURE 一 REGISTERJistener name 一 =" is used to restrict instance registration with database listeners. With this COST restriction in place only local instances will be allowed to register. These instructions can be used to address the issues published in Oracle Security Alert CVE by using COST to restrict connections to only local instances. About COST The class of secure transports (COST) parameters specify a list of transports that are considered secure for administration and registration of a particular listener. The COST parameters identify which transports are considered secure for that installation and whether the administration of a listener requires secure transports. COST will not affect client connections utilizing other protocols. For more details and for information about other available COST parameters please see the 11.2 Network Administrators Guide and Network Reference. About the IPC Protocol IPC protocol support is similar to BEQ protocol support in that it can only be used when the client program and the Oracle server are installed on the same system. IPC protocol support differs from BEQ protocol support in that it can be used with Oracle Shared Server configurations. IPC protocol support requires a listener for its operation. For more information about IPC please see Doc ID "IPC Explained".

2 Oracle versions that support COST Although not documented in the Oracle log Network Administration Guides COST parameters and functionality are supported as of Starting with Oracle Database Version and Oracle Database 12c ( ), the screening of service registration requests from database instances is performed using the Oracle Listener inherent "Valid Node Checking for Registration" feature. Oracle recommends using the "VNCR" feature in and 12c as an alternative to COST if the implementation is only to regulate database service registration requests with Listeners. If COST parameters are needed for Oracle Database or 12c for other or for additional reasons, then they should be used as intended. For more information information about "Valid Node Checking for Registration" in and 12c please reference the following links: Oracle Net 12c: Valid Node Checking For Registration (VNCR) (Doc ID ) Oracle Database Net Services Reference 12c Release 1(12.1) New features overview Oracle Clusterware Administration and Deployment Guide 12c Release 1(12.1) SCAN Listeners and Service Registration Restriction With Valid Node Checking SOLUTION There are two methods that can be used to protect the listener using COST nsecure_registerjistener_name =" in stand alone database installations. 1) Restricting registration to the TCP protocol (Requires the fix for BUG: ) _ or _ 2) Restricting registration to the IPC protocol (The patch for BUG: is NOT required for the IPC method) Either method accomplishes the same goal but it is your choice which to implement. Both methods will be discussed. Topics in this section:

3 m~~ 1) Setting a COST restriction using the TCP protocol to limit registration to local instances, 2) Setting a COST restriction using the IPC protocol to limit registration to local instances. 3) Verifying that COST is working. 1) Setting a COST restriction using the TCP protocol to limit registration to local instances. The patch for bug: allows for registration of the local node over TCP protocol provided that TCP is listed as a secure transport for registration. With the fix for in place registration attempts from non-local nodes over TCP will be refused. This patch is a requirement when securing a stand alone database listener and using the TCP protocol for registration. The patch for bug: can be used with all Oracle installations that utilize a listener whether they are RAC installations or standalone databases. Client Server Client 1 Listener Database k > Client ] J S5 SECURE_REGISTER_listener_name=(TCP) restricts communication between the database and the listener but does not affect client communication protocols. Steps: 1.1) Obtain and apply the patch for bug:

4 1.2) Add the COST TCP protocol restriction "SECURE_REGISTER_[listener_name] = (TCP)" to the listener.ora. Match the COST parameter variable listener_name with the name of the listener you are using in the listener.ora, e.g., If your listener name is " LISTENER_PROD" then use SECURE_REGISTER_LISTENER_PROD = (TCP) LISTENER_PRÿD = (DESCRIPTIÿN_LIST = (DESCRIPTION = (ADDRESS = (PROTOCOL TCP)(HOST = netfl-bde)(port = 1551)) SECURE REGISTER LISTENER PROD = (TCP) The database must be using the TCP protocol to register with the listener. Check the value of the startup parameter locauistener to confimÿ Important for grid installations: The grid agent uses the IPC protocol to contact and manage the listener so both IPC and TCP must be enabled in this step. For a grid environment use the following value, SECURE REGISTER LISTENER PROD = (IPC,TCP) 1.3) Restart the listener. The listener will now only accept database registration information from the local database and over TCP. With COST enabled for the TCP protocol attempts to register with the listener from anything other than the local system using TCP is rejected and an event is logged in the listener log. ll-may :27:23 * service_register_nsgr * 1194 TNS-01194: The listener command did not arrive in a secure transport 2) Setting a COST restriction using the IPC protocol to limit registration to local instances.

5 In the following section the IPC keyname "REGISTER" is being used as an example. IPC keynames must be unique for each listener on the same system, if the keyname "REGISTER" is used on the first of two listeners then the second listener must have a different keyname, e.g.,,,register2". If the setup already has IPC configured then it is a personal choice whether to create additional keys for registration, pre-exising IPC protocol address keynames can also be used for COST. mclient Server Client 1 _i i 丨遲 *.. Listener ~ Database Client SECURE_REGISTER_listener_name=(IPC) restricts communication between the database and the listener but does not affect client communication protocols. Steps: 2.1) Stop the listener 2.2) If it does not already exist, add support for the IPC protocol to the listener configuration " (ADDRESS= (PROTOCOL = IPC) (KEY = REGISTER)) If you already have an IPC key defined you may use it as is. Also add the COST parameter " SECURE_REGISTER_[listener_name] = (IPC) Match the COST parameter variable listener name with the name of the 一 listener you are using in the listener.ora, e.g., If your listener name is "LISTENER_PRÿD" then use SECURE REGISTER LISTENER PROD = (IPC) LISTENER.ORA LISTENER PROD

6 (DESCRIPTION LIST = (DESCRIPTION = (ADDRESS = (PROTOCOL = 工 PC)(KEY = REGISTER)) (ADDRESS = (PROTOCOL = TCP)(HOST = netfl-bde)(port = 1551)) SECURE REGISTER LISTENER PROD = (IPC) 2.3) Start the listener. LSNRCTL> start listener_prÿd Starting /uol/app/oracle/product/ll.2.0.3/bin/tnslsnr: please wait... TNSLSNR for Solaris: Version Production System parameter file is /uol/app/oracle/product/ll.2.0.3/network/admin/listener.ora Log messages written to /uol/app/oracle/diag/tnslsnr/netfl-bde/listener/alert/log.xml Listening on: (DESCRIPTIÿN=(ADDRESS=(PRÿTÿCÿL=ipc)(KEY=REGISTER))) Listening on: (DESCRIPTION:(ADDRESS=(PRÿTÿCÿL=tcp)(HÿST=netfl_bde us oracle com)(pÿrt=1551))) Connecting to (DESCRIPTION:(ADDRESS=(PRÿTÿCÿL=IPC)(KEY=REGISTER))) STATUS of the LISTENER Alias Version Start Date Uptime Trace Level Security SNMP Listener Parameter File Listener Log File Listening Endpoints Summary... (DESCRIPTIÿN=(ADDRESS=(PRÿTÿCÿL=ipc)(KEY=REGISTER))) (DESCRIPTIÿN=(ADDRESS=(PRÿTÿCÿL=tcp)(HÿST=netfl_bde.us.ÿracle.cÿm)(PÿRT=1551))) The listener supports The command completed LISTENER PROD TNSLSNR for Solaris: Version APR :34:20 0 days 0 hr. 0 min. 0 sec off ON: Local OS Authentication Production OFF /u01/app/oracle/product/ /network/admin/listener.ora /uol/app/oracle/diag/tnslsnr/netfl-bde/listener/alert/log.xml no services successfully 2.4) Replace the TCP address in the database localjistener parameter with the IPC address used by the listener. Some installations may be using a pfile rather than spfile as this example shows. In that case modify the pfile startup parameter to provide the same functionality.

7 SQL> show parameter local_listener NAME TYPE VALUE local listener string (ADDRESS = (PROTOCOL = TCP)(HO ST = netfl-bde)(port = 1551)) SQL> alter system set local_listener='(description=(address=(protocol=ipc)(key=register)))! scope = both; System altered. SQL> show parameter local_listener NAME TYPE VALUE local listener string (DESCRIPTIÿN=(ADDRESS=(PRÿTÿCÿ L=IPC> (KEY=REGISTER))) 2.5) Verify that the instance is now registered with the listener. LSNRCTL> services listener_prÿd Connecting to (DESCRIPTION:(ADDRESS=(PRÿTÿCÿL=IPC)(KEY=REGISTER))) Services Summary... Service "N11203.us.oracle.comn has 1 instance(s). Instance "N11203", status READY, has 1 handler(s) for this Handler(s): 'DEDICATED' established:0 refused:0 state:ready LOCAL SERVER The command completed successfully service.. With COST enabled attempts to register with the listener using a protocol other than IPC is rejected and an event is logged in the listener log. ll-may :27:23 * service_register_nsgr * 1194 TNS-01194: The listener command did not arrive in a secure transport 3) Verifying that COST is working Overview: To confirm the functionality of a COST configuration in a standalone database environment start the COST protected listener and attempt to register with it from a remote machine. A remotely registered instance will display as "REMOTE SERVER" in Isnrctl services output.

8 This is just one example of how to check. Configurations and listener output may vary per setup but the test logic remains the same; can an unauthorized protocol register with the listener? This same testing methodology can be used for COST restrictions using IPC, TCP or TCPS protocol or any combinations thereof. prerequisites: If the installation is using COST with a TCP restriction the patch for bug: should have already been applied. Two systems are required, the installation and listener you are verifying and a remote instance with which to attempt registration. Test Logic: First ensure that remote registration will take place with COST disabled, then re-enable COST and verify that it is restricting the same remote registration attempts. In this example patch is installed and COST is configured to restrict registration to the local node only over the TCP protocol. Steps: 3.1) Comment the COST rule in listener.ora and restart the listener. LISTENER_PRÿD = (DESCRIPTION = (ADDRESS_LIST= (ADDRESS=(PRÿTÿCÿL=IPC)(KEY=EXTPRÿC2)) (ADDRESS=(PROTOCOL = TCP)(HOST=netf1-bde)(PORT=1551)) #SECURE_REGISTER_LISTENER PRÿD = (TCP) 3.2) At the remote system that will be sending registration information to the listener being tested, load the target listeners TCP address into the database initialization parameter "remoteÿistener=". Enclose the address in single quotes and use the scope clause "scope=memory;". This action will tell the instance to also send registration packets to the remote listener over TCP. [mes2]/uol/app/oracle/product/10.2.0> sqlplus "/ as sysdba" SQL*Plus: Release Production on Fri May 4 10:11: Connected to: Oracle Database log Enterprise Edition Release bit Production With the Partitioning, OLAP, Data Mining and Real Application Testing options SQL> show parameter remote_listener; NAME TYPE VALUE remote listener string

9 SQL> alter system set remote_listener='(address=(protocol=tcp)(host=netf1-bde)(port=1551)) i scope=memory; System altered. 3.3) Back at the listener you should now see a service handler created for the remotely registered instance. Notice how it is listed as a REMOTE SERVER. LSNRCTL> services listener_prÿd Connecting to (DESCRIPTION:(ADDRESS=(PRÿTÿCÿL=IPC)(KEY=EXTPRÿC2))) Services Summary... Service "N102.us.oracle.com" has 1 instance(s). Instance "N102", status READY, has 1 handler(s) for this service... Handler(s): "DEDICATED" established:0 refused:0 state:ready REMOTE SERVER (ADDRESS=(PROTOCOL=TCP)(H0ST=mes2)(PORT=1521)) The command completed successfully 3.4) With remote registration confirmed test COST. Remove the comment from the COST parameter in the listener.ora and restart the listener. COST is now protecting the listener from registration attempts that are not coming from the local node. 3.5) At the remote instance force another registration attempt by issuing the SQL command "alter system register;". SQL> alter system register; System altered. SQL> 3.6) Check the listener for service handlers, no handlers for REMOTE SERVER(s) should be seen. [oracle@bde]$ lsnrctl LSNRCTL for Linux: Version MAY :42:57 Copyright (c) 1991, 2010, Oracle. All rights reserved. Welcome to LSNRCTL, type "help" for information. LSNRCTL> services listener_prod Connecting to (DESCRIPTION:(ADDRESS=(PRÿTÿCÿL=IPC)(KEY=EXTPRÿC2))) The listener supports no services The command completed successfully

10 3.7) Check the listener log, TNS messages will occur with each registration attempt that was refused. tail /uol/app/oracle/product/ /network/log/listener.log 04-MAY :43:03 * (CÿNNECT_DATA=(CID=(PRÿGRAM=)(HÿST=netfl_bde)(USER=oracle)) (CÿMMAND=services)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSIÿN= )) * services * 0 04-MAY :43:05 * service_register_nsgr * 1194 TNS-01194: The listener command did not arrive in a secure transport 04-MAY :44:05 * service register NSGR * 1194 TNS-01194: The listener command did not arrive in a secure transport With COST enabled the results of steps 3.6 and 3.7 above are expected and confirm that the COST registration restriction is working properly. 3.8) When finished testing dear the remotejistener value of the remote instance either by restarting or replacing the parameter in memory with a null string. SQL> alter system set remÿte_listener= i i scope=memory; System altered. This same test method will also confirm COST restrictions that are set to IPC or TCPS. Patch/fix information for BUG: The fix for BUG: will be included in Oracle PSU's that include the fix: Cumulative Patch Inclusion - DBPSU (Released) Cumulative Patch Inclusion - DBPSU (Released) Cumulative Patch Inclusion - DBPSU (Released) Cumulative Patch Inclusion - DBPSU (Released) Cumulative Patch Inclusion - DBPSU (Released)

11 Windows patch availability for bugfix: : is included in bundle 6 (Released) 32-bit : Patch bit : Patch : is included in bundle 19 (Released) 32-bit : Patch bit : Patch : is included in bundle 46 (Released) : is included in bundle 17 (Released) REFERENCES NOTE:134Q Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC NÿTE: IPC Explained NQTE: Valid Node Checking For Registration (VNCR) NOTE:1455Q Force Connections to a Specific Database Service When two Identical Services are Registered to CMAN 未找到您要查找的产品?