Re: Listener Passwords, who uses them and why?

Dave wrote:
> As the subject says, just curious how many people out there have
> passwords on their listeners?
>
> Some external group auditing us for SOX is saying that its a best
> practice but in my 8 years as a DBA i've never seen it.
>
> I can see if we had problems with listeners going down unexpectedly but
> this has never happened. Are there security holes that I should be
> aware of that recommend having a password?
>
> (I'm aware of the iSQLPlus bug in the latest Oracle CPU, but we don't
> use it..)
>
> tnx.
>

Remotely shutting down a listener which is not password protected is probably one of the least serious thing one can do.

Couple other things one can do:
* Gain access to database as dba
* Blow up your database files or for that matter, any file owned by oracle.

Now thats serious .. right? Not only should you password protect your listener, you should also set admin_restrictions_<listener>=ON if its available for your version.

All this is for below 10g listeners. 10g listener has default security on.

Anurag Received on Wed Aug 03 2005 - 19:16:03 CDT