Blocking access to Oracle ports 1521/1526

[Tom Dawson]

Hi,

I'm trying to block access to our Oracle database from users on a certain subnet. The suggestion I got from HP Support was to make entries in hosts.allow/hosts.deny. I was under the impression that those files were part of the tcp_wrapper product. Is my assumption correct?

Also, since the Oracle listener is not an inetd controlled program, would tcp_wrapper do me any good?

Making entries in /var/adm/inetd.sec doesn't do any good because, again, the Oracle listener is not an inetd controlled program.

I'm trying to make some simple change at the network layer so we can still allow access to the Oracle db from other subnets.

Any ideas?

Thanks,
Tom

[Craig Rants · Accepted solution]

You are right wrappers and inetd will not work unless oracle was comipled with libwrap.a which I doubt.

I would recommend installing IPF/9000. It is product B9901AA on App CD 1.

The entry to block access to those ports in the ipf.conf file would be

block in quick proto tcp from any to IP/32 port = 1521

same with port 1526,

I have mine setup into groups which helps in filtering... but I digress

GL,
C

[Christopher Caldwell]

Use IPFilter (available from software.hp.com) or block at the network device (i.e. if you're network is isolated by a router, add an access control list to the router).

[Tom Dawson]

Craig, Cristopher,

Thanks! It looks like that's just what I need. The only problem is, it appears that IPFilter is only available for 11.x. I'm migrating from 10.20 to 11.11 this weekend and I had hoped to be able to easily restrict access to the db on 10.20 while we did maintenance from our workstations preparing for the migration.

But it's not that big a problem. As Cristopher suggested, I'll have our WAN administrator do some blocking at the router and we ought to be fairly safe. And next week I'll be installing IPF/9000 on the 11.11 server.

Thanks again,
Tom

[Craig Rants]

Depending on what type of 11i you have, IPF will be installed. The 11i Enterprise OE and above has the 11i installed on it with other things like MirrorDisk and OnlineJFS.

Happy Migrating...

GL,
C

[Aashish Raj]

Alternately you can do the same by configuring Connection manager which comes with oracle although their is some configuration level overhead involved with it.

AR

[Tom Dawson]

Stefan,

Thanks! It worked like a champ. I found a detailed document on using protocol.ora at metalink.oracle.com and just created a protocol.ora file with these entries:

tcp.validnode_checking = yes
tcp.invited_nodes = ( myhost )

Aashish,

Thanks. But since Stefan's simple method worked, I'll forgo implementing Connection Manager.

Tom