ACE Director Alum Daniel Morgan, founder of Morgan's Library, is scheduling
complimentary technical Workshops on Database Security for the first 30
Oracle Database customers located anywhere in North America, EMEA, LATAM, or
APAC that send an email to
asra_us@oracle.com. Request a Workshop for
your organization today.
Purpose
The listener's involvement is summarized as:
the listener catches the request
spawns or requests a database process/thread
redirects or passes the connection to the process/thread, usually on a different port
setting an encrypted listener password was dropped by Oracle as of version 11.2. That, unfortunately has not stopped a lot of organizations that don't keep up with current versions, both Oracle customers and auditors,
from demanding that the listener be password protected. It cannot be any longer and the best solution should you find one of these dinosaurs is to open an SR, get Oracle to state it for them explicitly, and then send them a copy of Oracle's response to your SR.
For any that may still have an antique copy of the database in their operations here's how it was done from a terminal window as the user "oracle".
? lsnrctl start
LSNRCTL> change_password
Old password:
New password:
Reenter new password:
LSNRCTL> save_config
Listener Commands
Exit
quit the listener application
/u01/orahome19/db_home/bin>lsnrctl
LSNRCTL> exit
Help
view help information
c:\u01\orahome19\db_home\bin>lsnrctl help
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 07:53:27
Copyright (c) 1991, 2019, Oracle. All rights reserved.
The following operations are available
An asterisk (*) denotes a modifier or extended command:
start stop status services
servacls version reload save_config
trace quit exit set*
show*
Quit
quit the listener application
/u01/orahome19/db_home/bin>lsnrctl
LSNRCTL> quit
Reload
Causes a reread the listener.ora file. Enables the addition or modification of statically configured services without stopping the listener.
In addition, the database services, instances, service handlers, and listening endpoints that were dynamically registered with the listener are unregistered and subsequently registered again.
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
The command completed successfully
Save Configuration
Use the SAVE_CONFIG command to compare the current configuration state of the listener, including trace level, trace file, trace directory, and logging to the listener.ora file.
Any changes are stored in listener.ora, preserving formatting, comments, and case as much as possible. Prior to modification of the listener.ora file, a backup of the file, called listener.bak, is created.
save <listener_name>
save_config <listener_name>
LSNRCTL> save listener
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
No changes to save for LISTENER.
The command completed successfully
Servacls
Returns the service ACL information for the named listener
servacls <listener_name>
LSNRCTL> servacls listener
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
Service ACLs Summary...
Service "52448234712340b69f274bcc790ecfe0" has 1 instance(s).
Instance "orabasexix": 0 failure(s), status READY...
Service "60c35de26c5044f18bac7ac8b617638e" has 1 instance(s).
Instance "orabasexix": 0 failure(s), status READY...
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc": 0 failure(s), status UNKNOWN...
Service "orabasexix" has 1 instance(s).
Instance "orabasexix": 0 failure(s), status READY...
Service "orabasexixXDB" has 1 instance(s).
Instance "orabasexix": 0 failure(s), status READY...
Service "pdbdev" has 1 instance(s).
Instance "orabasexix": 0 failure(s), status READY...
The command completed successfully
Services
View the configured listener service
LSNRCTL> services
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
Services Summary...
Service "52448234712340b69f274bcc790ecfe0" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:1 refused:0 state:ready
LOCAL SERVER
Service "60c35de26c5044f18bac7ac8b617638e" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:1 refused:0 state:ready
LOCAL SERVER
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:0 refused:0
LOCAL SERVER
Service "orabasexix" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:1 refused:0 state:ready
LOCAL SERVER
Service "orabasexixXDB" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Handler(s):
"D000" established:0 refused:0 current:0 max:1022 state:ready
DISPATCHER <machine: PERRITO5, pid: 11136>
(ADDRESS=(PROTOCOL=tcp)(HOST=PERRITO5)(PORT=49712))
Service "pdbdev" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Handler(s):
"DEDICATED" established:1 refused:0 state:ready
LOCAL SERVER
The command completed successfully
Set
Parameter
Syntax & Usage
current_listener
set current_listener <listener_name>
LSNRCTL> set current_listener uwlistener
displaymode
set displaymode <RAW | COMPAT | NORMAL | VEBOSE>
LSNRCTL> set displaymode VERBOSE
inbound_connect_timeout
set inbound_connect_timeout <value>
LSNRCTL> set inbound_connect_timeout 0
log_directory
set log_directory <directory_path>
LSNRCTL> set log_directory c:\tmp
log_file
set log_file <file_name>
LSNRCTL> set log_file uwlistener.log
log_status
set log_status < ON | OFF>
LSNRCTL> set log_status ON
password
set password
Deprecated in 11.2
rawmode
set rawmode <ON | OFF>
LSNRCTL> set rawmode OFF
save_config_on_stop
set save_config_on_stop <ON | OFF>
LSNRCTL> set save_config_on_stop ON
startup_waittime
set startup_waittime <value>
LSNRCTL> set startup_waittime 0
trc_directory
set trc_directory <directory path>
LSNRCTL> set trc_directory c:\tmp
trc_file
set trc_level <file_name>
LSNRCTL> set trc_file uwlistener.trc
trc_level
set trc_level <value>
Value
Description
0 - 1
off
2 - 3
err
4 - 5
user
6 - 14
admin
15
dev
16 - 99
support
LSNRCTL> set trc_level 0
Show
Parameter
Syntax & Usage
current_listener
show current_listener <listener_name>
LSNRCTL> show current_listener
displaymode
show displaymode
LSNRCTL> show displaymode
inbound_connect_timeout
show inbound_connect_timeout
LSNRCTL> show inbound_connect_timeout
log_directory
show log_directory
LSNRCTL> show log_directory
log_file
show log_file
LSNRCTL> show log_file
log_status
show log_status
ON if listener activity is logged
LSNRCTL> show log_status
rawmode
show rawmode
LSNRCTL> show rawmode
save_config_on_stop
show save_config_on_stop
LSNRCTL> show
snmp_visible
show snmp_visible
LSNRCTL> show snmp_visible
startup_waittime
show startup_waittime
LSNRCTL> show startup_waittime
Default is 0
trc_directory
show trc_directory
LSNRCTL> show trc_directory
trc_file
show trc_file
Default is listener.trc
LSNRCTL> show trc_file
trc_level
show trc_level
LSNRCTL> show trc_level
Start
Start the listener
c:\u01\orahome19\db_home\bin>lsnrctl start
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 09:54:52
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Starting tnslsnr: please wait...
TNSLSNR for 64-bit Windows: Version 19.0.0.0.0 - Production
System parameter file is
C:\u01\orahome19\WINDOWS.X64_193000_db_home\network\admin\listener.ora
Log messages written to C:\u01\orabase19\diag\tnslsnr\PERRITO5\listener\alert\log.xml
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521)))
Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for 64-bit Windows: Version 19.0.0.0.0 - Production
Start Date 17-JUL-2019 09:54:55
Uptime 0 days 0 hr. 1 min. 58 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File
C:\u01\orahome19\WINDOWS.X64_193000_db_home\network\admin\listener.ora
Listener Log File C:\u01\orabase19\diag\tnslsnr\PERRITO5\listener\alert\log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
Services Summary...
Service "52448234712340b69f274bcc790ecfe0" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "60c35de26c5044f18bac7ac8b617638e" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this
service...
Service "orabasexix" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "orabasexixXDB" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "pdbdev" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
The command completed successfully
Status
View the current listener status
c:\u01\orahome19\db_home/bin>lsnrctl status
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019
09:57:51
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
STATUS of the LISTENER
------------------------
Alias LISTENER
Version TNSLSNR for 64-bit Windows: Version 19.0.0.0.0 - Production
Start Date 17-JUL-2019 09:54:55
Uptime 0 days 0 hr. 2 min. 57 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File
C:\u01\orahome19\WINDOWS.X64_193000_db_home\network\admin\listener.ora
Listener Log File C:\u01\orabase19\diag\tnslsnr\PERRITO5\listener\alert\log.xml
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(PIPENAME=\\.\pipe\EXTPROC1521ipc)))
Services Summary...
Service "52448234712340b69f274bcc790ecfe0" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "60c35de26c5044f18bac7ac8b617638e" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "CLRExtProc" has 1 instance(s).
Instance "CLRExtProc", status UNKNOWN, has 1 handler(s) for this
service...
Service "orabasexix" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "orabasexixXDB" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
Service "pdbdev" has 1 instance(s).
Instance "orabasexix", status READY, has 1 handler(s) for this service...
The command completed successfully
Stop
Stop the listener
c:\u01\orahome19\db_home\bin>lsnrctl stop
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 09:59:27
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
The command completed successfully
Trace
trace the listener
<[OFF | USER | ADMIN | SUPPORT]> <trace_level>
c:\u01\orahome19\db_home\bin>lsnrctl trace admin
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 12:54:13
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
Opened trace file: C:\u01\orabase19\diag\tnslsnr\PERRITO5\listener\trace\ora_12600_2672.trc
The command completed successfully
c:\u01\orahome19\db_home\bin>lsnrctl trace off
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 12:54:39
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
The command completed successfully
Version
Show the currently installed listener version
c:\u01\orahome19\db_home\bin>lsnrctl version
LSNRCTL for 64-bit Windows: Version 19.0.0.0.0 - Production on 17-JUL-2019 12:50:15
Copyright (c) 1991, 2019, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=127.0.0.1)(PORT=1521)))
TNSLSNR for 64-bit Windows: Version 19.0.0.0.0 - Production
TNS for 64-bit Windows: Version 19.0.0.0.0 - Production
Oracle Bequeath NT Protocol Adapter for 64-bit Windows: Version 19.0.0.0.0 - Production
Windows NT Named Pipes NT Protocol Adapter for 64-bit Windows: Version 19.0.0.0.0 - Production
Windows NT TCP/IP NT Protocol Adapter for 64-bit Windows: Version
19.0.0.0.0 - Production
The command completed successfully
Listener Related Startup Parameters
ADMIN_RESTRICTIONS
Prevent remote modification of listener.ora using lsnrctl commands
ADMIN_RESTRICTIONS_[listener_name]=<ON | OFF>
ADMIN_RESTRICTIONS_ORABASE=ON
ADR_BASE
Specifies the base directory in to which tracing and logging incidents are stored when ADR is enabled
By default, the Oracle Net listener notifies Cluster Ready Services (CRS) when it is started or stopped
CRS_NOTIFICATION_[listener_name]=<ON | OFF>
CRS_NOTIFICATION_LISTENER=ON
DEFAULT_SERVICE
Enables users to connect to the database without having to specify a service name from the client
DEFAULT_SERVICE_[listener_name]=<service_name>
TBD
DIAG_ADR_ENABLED
Enables/Disables ADR for the listener
DIAG_ADR_ENABLED<_listener_name> <ON | OFF>
DIAG_ADR_ENABLED_listener=ON
FIREWALL
Enables strict ACL validation (whitelist-based approach) of all connections coming on this endpoint. If no ACLs are configured for a service, all connections are rejected for that service.
Specifies the number of concurrent connection requests that the listener can accept on a TCP/IP or IPC listening endpoint (protocol address).
The default number of concurrent connection requests is operating system specific.
Indicates that a particular listening endpoint is rate limited. RATE_LIMIT is used to prevent denial of service (DOS) attacks on a database or to control a logon storm such as may be caused by a application server reboot.
When CONNECTION_RATE_LISTENER is specified ports are enabled YES/NO. When not specified RATE_LIMIT can be used to adjust the rate on a port-by-port basis.
Should always be configured for Data Guard Replication
Send Buffer Size
SEND_BUF_SIZE=<buffer_size_in_bytes>
See RECV_BUF_SIZE listing above
SSL_CLIENT_AUTHENTICATION
Specify if a client is authenticated using the Secure Sockets Layer (SSL)
SSL_CLIENT_AUTHENTICATION=<TRUE | FALSE>
SSL_CLIENT_AUTHENTICATION=TRUE
SUBSCRIBE_FOR_NODE_DOWN _EVENT
To subscribe to Oracle Notification Service (ONS) notifications for downed events
SUBSCRIBE_FOR_NODE_DOWN_EVENT
TBD
TRACE_TIMESTAMP
Adds a timestamp to every trace event in the listener trace file
TRACE_TIMSTAMP<_listener_name> <ON | TRUE | OFF | FALSE>
TRACE_TIMESTAMP_LISTENER=TRUE
TRACE_LEVEL
Sets the trace level
Value equivalents:
OFF (equivalent to 0) provides no tracing
USER (equivalent to 4) identify user error error conditions
ADMIN (equivalent to 6) identify installation-specific problems
SUPPORT (equivalent to 16) provides trace information for support
Trace file results are written to $ORACLE_HOME/network/trace.
TRACE_LEVEL<_listener_name> = <value>
TRACE_LEVEL_LISTENER=USER
WALLET_LOCATION
Specify the location of wallets. Wallets are certificates, keys, and trustpoints processed by SSL that allow for secure connections