Access Control Settings in sqlnet.ora
| Oracle Net Manager Field/Option | sqlnet.ora File Parameter | Description |
|---|---|---|
|
Use to specify whether to screen access to the database. If this field is selected, Oracle Net Manager checks the parameters TCP.EXCLUDED_NODES and TCP.VALIDNODE_CHECKING to determine which clients to allow access to the database. If this field is deselected, Oracle Net Manager does not screen clients. |
||
|
Use to specify which clients using the TCP/IP protocol are denied access to the database. |
||
|
Clients allowed to access |
当我们需要屏蔽某些服务器时，或者说我们只希望某些ip可以连接时，我们可以通过设置sqlnet.ora实现。
设置前
在 192.168.6.52使用tnsping测试
[16:21:27 oracle@david_dgp ~]$ tnsping mydgl
TNS Ping Utility for Linux: Version 11.2.0.3.0 - Production on 25-JUL-2013 16:21:35
Copyright (c) 1997, 2011, Oracle. All rights reserved.
Used parameter files:
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.6.53)(PORT = 1530)) (CONNECT_DATA = (SERVER = DEDICATED) (SID = myora)))
OK (0 msec)
在mydgl sqlnet.ora中添加如下内容：
TCP.VALIDNODE_CHECKING = YES
NAMES.DIRECTORY_PATH= (TNSNAMES)
TCP.INVITED_NODES= (192.168.6.53,192.168.6.51)
TCP.EXCLUDED_NODES= (192.168.6.52)
重启listener。
在 6.52上重新测试
[16:22:13 oracle@david_dgp ~]$ tnsping mydgl
TNS Ping Utility for Linux: Version 11.2.0.3.0 - Production on 25-JUL-2013 16:22:48
Copyright (c) 1997, 2011, Oracle. All rights reserved.
Used parameter files:
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.6.53)(PORT = 1530)) (CONNECT_DATA = (SERVER = DEDICATED) (SID = myora)))
TNS-12547: TNS:lost contact
可以发现已经不能解析
在6.51上测试
[16:17:55 oracle@david_pri admin]$ tnsping mydgl
TNS Ping Utility for Linux: Version 11.2.0.3.0 - Production on 25-JUL-2013 16:24:06
Copyright (c) 1997, 2011, Oracle. All rights reserved.
Used parameter files:
/u01/app/oracle/product/11.2.0/db/network/admin/sqlnet.ora
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.6.53)(PORT = 1530)) (CONNECT_DATA = (SERVER = DEDICATED) (SID = myora)))
OK (0 msec)
这将使我们在需要的时候控制某些ip的连接