Re: Listener Passwords, who uses them and why?

Hi Dave,

You definitely need to set a listener password and also use ADMIN_RESTRICTIONS_{listenername} to prevent any dynamic changes being made to the listener parameters.

Quite simply without a password you should be worried about more than just someone stopping the listener. There are many security issues with the listener that can allow a hacker to gain DBA privileges in the database or to own the server or to overwrite any file accessible to the owner of the listener process on the server.

On the failed_login_attempts profile parameter. I would recommend that it is set for all database users. You will need to define a suitable value for different groups of users such as DBA's, developers, normal application users, power users etc. If you do not set this parameter then you leave your database open to someone attempting dictionary or brute force attacks on your users passwords.

There are some good Oracle security checklists on my Oracle security white papers page http://www.petefinnigan.com/orasec.htm that you might find useful

kind regards

Pete

-- 
Pete Finnigan (email:pete_at_petefinnigan.com)
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Forum: http://www.petefinnigan.com/forum/yabb/YaBB.cgi
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.