Problem on restricting host using sqlnet.ora in 9i

[sambavan]

Folks,

Oracle 9i Rel 2 pach 3
OS Solaris 9

I am having a problem on restricting the access from the clients based on the host names. I have the following parameters set in my sqlnet.ora file

          TCP.NODELAY=yes          
          TCP.VALIDNODE_CHECKING=yes
          TCP.INVITED_NODES= (host1, host2,...)

After putting this entries in the sqlnet.ora, I was still being able to connect to the instances from the hosts that were not listed under the invited_nodes.

Some may say to restart the listener. I did that too, but still being able to connect to the instances from the hosts that were not listed under the invited nodes lists.

Rememeber this is 9i, so protocol.ora is obsolete in this.

Did anyone come across this problem? If so what was your solution? Any help would greatly be appreciated.

Thanx,

Sam

[oddster]

mmm interesting.

Can you try setting TNS_ADMIN variable, then restart the listener.

Also, do you list host names or IP addresses.

You probably should also check out Security Alert #38.

Brgds,

Andrew Oddy

[abhaysk]

Multiple Listners Enabled on different nodes?

[sambavan]

TNS_ADMIN was set in the first place. Regarding multiple listeners on different nodes no. But Multiple listeners on single node yes.

Any further thoughts.

Sam

[sambavan]

O.K here is the solution, which is quiet painful. In a list of around 100 invited nodes, the nslookup for 2 nodes failed. As a result the listener would just skip the loading of the restricted node list. So this was the cause of all the problems. On compaing the node list with the loaded node list from the trace revealed the problem. The listener instead of skipping the nodes that it cannot load, just resolute to diregard the valid node list.

Sam

[sanga]

Sam,

Can we allow certain hosts using sqlnet.ora in oracle 9i

Thanks,

[sambavan]

Yes you can restrict the access to the server using the sqlnet.ora file. As I mentioned on my first posting, set those parameters on the server side sqlnet.ora file and then stop and start the listener. That will allow access to only those hosts listed under invided nodes.

Hope this would help you.

Sam

[sonuji_in]

Hi Sam
Thanks for information on Oracle Security Issues.
inspite of sqlnet.ora, you can also set cman(connection manager).
it will also work as a fierwall.have you tried this.
thanks
Abhishek