Restricting the fly listener administration using the ADMIN_RESTRICTION_LISTENER parameter

Using the set lsnrctl command listener, we may dynamically change and override parameters. An attacker may use this capability for his own advantage by launching a series of DoS attacks against the database. The simplest DoS attack example is to simply stop the listener. Other DoS attacks can be produced by setting the listener trace (for example set listener trace to overwrite system01.dbf - set trc_file '/u01/HACKDB/system01.dbf')or log files to overwrite data files or redo logs, or they can be used to generate scripts in a desired location that may be used later.

Getting ready

All steps will be performed on nodeorcl1.

How to do it...

1. The format of parameter is ADMIN_RESTRICTION_listener_name. In our case we will disable the fly administration of the listener named LISTENER. Open $ORACLE_HOME/network/admin/listener.ora and enable ADMIN_RESTRICTION_LISTENER as follows:

   ADMIN_RESTRICTION_LISTENER=ON
   

2. Reload...