{"id":287,"date":"2013-01-12T16:15:55","date_gmt":"2013-01-12T08:15:55","guid":{"rendered":"http:\/\/www.yallonking.com\/?p=287"},"modified":"2013-01-23T00:03:57","modified_gmt":"2013-01-22T16:03:57","slug":"oralce%e5%ae%89%e5%85%a8%e4%b9%8brac%e9%85%8d%e7%bd%aeclass-of-secure-transportcost","status":"publish","type":"post","link":"http:\/\/www.yallonking.com\/?p=287","title":{"rendered":"ORALCE\u5b89\u5168\u4e4bRAC\u914d\u7f6eClass of Secure Transport(COST)"},"content":{"rendered":"

ORALCE\u5b89\u5168\u4e4bRAC\u914d\u7f6eClass of Secure Transport(COST)
\n--\u53c2\u7167\u6587\u6863
\n--Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC [ID 1340831.1]<\/p>\n

[oracle@rac1 ~]$ crs_stat -t
\nName Type Target State Host
\n------------------------------------------------------------
\nora....SM1.asm application ONLINE ONLINE rac1
\nora....C1.lsnr application ONLINE ONLINE rac1
\nora.rac1.gsd application ONLINE ONLINE rac1
\nora.rac1.ons application ONLINE ONLINE rac1
\nora.rac1.vip application ONLINE ONLINE rac1
\nora....SM2.asm application ONLINE ONLINE rac2
\nora....C2.lsnr application ONLINE ONLINE rac2
\nora.rac2.gsd application ONLINE ONLINE rac2
\nora.rac2.ons application ONLINE ONLINE rac2
\nora.rac2.vip application ONLINE ONLINE rac2
\nora.racdb.db application ONLINE ONLINE rac2
\nora....b1.inst application ONLINE ONLINE rac1
\nora....b2.inst application ONLINE ONLINE rac2<\/p>\n

--\u521b\u5efacost\u5b58\u653e\u76ee\u5f55\uff08\u6240\u6709\u8282\u70b9\uff09
\n[oracle@rac1 ~]$ mkdir \/opt\/ora10g\/product\/database\/network\/admin\/cost
\n--\u521b\u5efa\u5bc6\u94a5\uff08\u6240\u6709\u8282\u70b9\uff09
\n[oracle@rac1 ~]$ orapki wallet create -wallet \/opt\/ora10g\/product\/database\/network\/admin\/cost
\nEnter password:<\/p>\n

Enter password again:<\/p>\n

[oracle@rac1 ~]$ orapki wallet add -wallet \/opt\/ora10g\/product\/database\/network\/admin\/cost -self_signed -dn \"cn=secure_register\" -keysize 1024 -validity 3650
\nEnter wallet password:
\n[oracle@rac1 ~]$ orapki wallet display -wallet \/opt\/ora10g\/product\/database\/network\/admin\/cost
\nEnter wallet password:<\/p>\n

Requested Certificates:
\nUser Certificates:
\nSubject: CN=secure_register
\nTrusted Certificates:
\nSubject: CN=GTE CyberTrust Root,O=GTE Corporation,C=US
\nSubject: OU=Class 3 Public Primary Certification Authority,O=VeriSign\\, Inc.,C=US
\nSubject: OU=Class 2 Public Primary Certification Authority,O=VeriSign\\, Inc.,C=US
\nSubject: OU=Class 1 Public Primary Certification Authority,O=VeriSign\\, Inc.,C=US
\nSubject: OU=Secure Server Certification Authority,O=RSA Data Security\\, Inc.,C=US
\nSubject: CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\\, Inc.,O=GTE Corporation,C=US
\nSubject: CN=secure_register
\nSubject: CN=Entrust.net Secure Server Certification Authority,OU=(c) 2000 Entrust.net Limited,OU=www.entrust.net\/SSL_CPS incorp. by ref. (limits liab.),O=Entrust.net
\nSubject: CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net\/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
\nSubject: CN=Entrust.net Secure Server Certification Authority,OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net\/CPS incorp. by ref. (limits liab.),O=Entrust.net,C=US<\/p>\n

[oracle@rac2 ~]$ mkdir \/opt\/ora10g\/product\/database\/network\/admin\/cost
\n[oracle@rac1 cost]$ scp \/opt\/ora10g\/product\/database\/network\/admin\/cost\/*.* rac2:\/opt\/ora10g\/product\/database\/network\/admin\/cost\/
\newallet.p12 100% 10KB 9.8KB\/s 00:00<\/p>\n

--\u5404\u81ea\u8282\u70b9\u5206\u522b\u521b\u5efa\u5bc6\u94a5
\n[oracle@rac1 ~]$ orapki wallet create -wallet \/opt\/ora10g\/product\/database\/network\/admin\/cost -auto_login
\nEnter wallet password:
\n[oracle@rac2 ~]$ orapki wallet create -wallet \/opt\/ora10g\/product\/database\/network\/admin\/cost -auto_login
\nEnter wallet password:<\/p>\n

--\u4fee\u6539\u76d1\u542c\u914d\u7f6e\uff08\u6240\u6709\u8282\u70b9\uff09
\n[oracle@rac1 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac1 admin]$ cat listener.ora
\n# listener.ora.rac1 Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora.rac1
\n# Generated by Oracle configuration tools.<\/p>\n

LISTENER_RAC1 =
\n(DESCRIPTION_LIST =
\n(DESCRIPTION =
\n# (ADDRESS = (PROTOCOL = IPC)(KEY = REGISTER))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac1-vip)(PORT = 1523)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.151)(PORT = 1521)(IP = FIRST))
\n)
\n)<\/p>\n

#cost add
\nWALLET_LOCATION =
\n(SOURCE =
\n(METHOD = FILE)
\n(METHOD_DATA =
\n(DIRECTORY = \/opt\/ora10g\/product\/database\/network\/admin\/cost)
\n)
\n)<\/p>\n

#SECURE_REGISTER_LISTENER_RAC1 = (IPC)
\n#SECURE_REGISTER_LISTENER_RAC1 = (TCP,TCPS)<\/p>\n

SID_LIST_LISTENER_RAC1 =
\n(SID_LIST =
\n(SID_DESC =
\n(SID_NAME = PLSExtProc)
\n(ORACLE_HOME = \/opt\/ora10g\/product\/database)
\n(PROGRAM = extproc)
\n)
\n)<\/p>\n

[oracle@rac2 admin]$ cat listener.ora
\n# listener.ora.rac2 Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora.rac2
\n# Generated by Oracle configuration tools.<\/p>\n

LISTENER_RAC2 =
\n(DESCRIPTION_LIST =
\n(DESCRIPTION =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac2-vip)(PORT = 1523)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.152)(PORT = 1521)(IP = FIRST))
\n)
\n)<\/p>\n

#cost add
\nWALLET_LOCATION =
\n(SOURCE =
\n(METHOD = FILE)
\n(METHOD_DATA =
\n(DIRECTORY = \/opt\/ora10g\/product\/database\/network\/admin\/cost)
\n)
\n)<\/p>\n

#SECURE_REGISTER_LISTENER_RAC2 = (TCP,TCPS)<\/p>\n

SID_LIST_LISTENER_RAC2 =
\n(SID_LIST =
\n(SID_DESC =
\n(SID_NAME = PLSExtProc)
\n(ORACLE_HOME = \/opt\/ora10g\/product\/database)
\n(PROGRAM = extproc)
\n)
\n)<\/p>\n

#LISTENER =
\n# (DESCRIPTION_LIST =
\n# (DESCRIPTION =
\n# (ADDRESS = (PROTOCOL = TCP)(HOST = rac2)(PORT = 1521))
\n# )
\n# )<\/p>\n

--\u91cd\u542f\u5404\u81ea\u8282\u70b9\u76d1\u542c
\n[oracle@rac1 ~]$ srvctl stop listener -n rac1
\n[oracle@rac1 ~]$ srvctl start listener -n rac1
\n[oracle@rac1 ~]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 15:10:18<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 15:10:12
\nUptime 0 days 0 hr. 0 min. 6 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

[oracle@rac2 ~]$ srvctl stop listener -n rac2
\n[oracle@rac2 ~]$ srvctl start listener -n rac2
\n[oracle@rac2 ~]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 15:11:33<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac2)(PORT=1521)))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC2
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 15:11:27
\nUptime 0 days 0 hr. 0 min. 5 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac2.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.154)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.154)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.152)(PORT=1521)))
\nServices Summary...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u6240\u6709\u8282\u70b9\u914d\u7f6esqlnet.ora
\n[oracle@rac1 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac1 admin]$ cat sqlnet.ora
\nWALLET_LOCATION =
\n(SOURCE =
\n(METHOD = FILE)
\n(METHOD_DATA =
\n(DIRECTORY = \/opt\/ora10g\/product\/database\/network\/admin\/cost)
\n)
\n)<\/p>\n

[oracle@rac1 admin]$ scp sqlnet.ora rac2:\/opt\/ora10g\/product\/database\/network\/admin\/
\nsqlnet.ora 100% 151 0.2KB\/s 00:00<\/p>\n

--\u67e5\u770bremote_listener\u914d\u7f6e
\n[oracle@rac1 ~]$ sqlplus \/nolog<\/p>\n

SQL*Plus: Release 10.2.0.5.0 - Production on Wed Sep 12 15:19:38 2012<\/p>\n

Copyright (c) 1982, 2010, Oracle. All Rights Reserved.<\/p>\n

SQL> conn \/as sysdba
\nConnected.
\nSQL> show parameter remote_listener<\/p>\n

NAME TYPE VALUE
\n------------------------------------ ----------- ------------------------------
\nremote_listener string LISTENERS_RACDB<\/p>\n

--\u4fee\u6539\u6240\u6709\u8282\u70b9tnsnames.ora
\n[oracle@rac1 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac1 admin]$ cat tnsnames.ora
\n# tnsnames.ora Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/tnsnames.ora
\n# Generated by Oracle configuration tools.<\/p>\n

RACDB1 =
\n(DESCRIPTION =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
\n(CONNECT_DATA =
\n(SERVER = DEDICATED)
\n(SERVICE_NAME = racdb)
\n(INSTANCE_NAME = racdb1)
\n)
\n)<\/p>\n

RACDB =
\n(DESCRIPTION =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
\n(LOAD_BALANCE = yes)
\n(CONNECT_DATA =
\n(SERVER = DEDICATED)
\n(SERVICE_NAME = racdb)
\n)
\n)<\/p>\n

LISTENERS_RACDB =
\n(ADDRESS_LIST =
\n# (ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
\n# (ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac1-vip)(PORT = 1523))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac2-vip)(PORT = 1523))
\n)<\/p>\n

EXTPROC_CONNECTION_DATA =
\n(DESCRIPTION =
\n(ADDRESS_LIST =
\n(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC0))
\n)
\n(CONNECT_DATA =
\n(SID = PLSExtProc)
\n(PRESENTATION = RO)
\n)
\n)<\/p>\n

RACDB2 =
\n(DESCRIPTION =
\n(ADDRESS_LIST =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.152)(PORT = 1521))
\n)
\n(CONNECT_DATA =
\n(SERVICE_NAME = racdb2)
\n)
\n)<\/p>\n

[oracle@rac2 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac2 admin]$ cat tnsnames.ora
\n# tnsnames.ora Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/tnsnames.ora
\n# Generated by Oracle configuration tools.<\/p>\n

RACDB2 =
\n(DESCRIPTION =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
\n(CONNECT_DATA =
\n(SERVER = DEDICATED)
\n(SERVICE_NAME = racdb)
\n(INSTANCE_NAME = racdb2)
\n)
\n)<\/p>\n

RACDB =
\n(DESCRIPTION =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
\n(LOAD_BALANCE = yes)
\n(CONNECT_DATA =
\n(SERVER = DEDICATED)
\n(SERVICE_NAME = racdb)
\n)
\n)<\/p>\n

LISTENERS_RACDB =
\n(ADDRESS_LIST =
\n# (ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
\n# (ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac1-vip)(PORT = 1523))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac2-vip)(PORT = 1523))
\n)<\/p>\n

EXTPROC_CONNECTION_DATA =
\n(DESCRIPTION =
\n(ADDRESS_LIST =
\n(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC0))
\n)
\n(CONNECT_DATA =
\n(SID = PLSExtProc)
\n(PRESENTATION = RO)
\n)
\n)<\/p>\n

RACDB1 =
\n(DESCRIPTION =
\n(ADDRESS_LIST =
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.151)(PORT = 1521))
\n)
\n(CONNECT_DATA =
\n(SERVICE_NAME = racdb1)
\n)
\n)
\n100% 1297 1.3KB\/s 00:00<\/p>\n

--\u8fdc\u7a0b\u91cd\u542f\u5404\u4e2a\u8282\u70b9
\n[oracle@rac1 ~]$ srvctl stop instance -d racdb -i racdb2 -o immediate
\n[oracle@rac1 ~]$ srvctl start instance -d racdb -i racdb2
\n[oracle@rac2 ~]$ srvctl stop instance -d racdb -i racdb1 -o immediate
\n[oracle@rac2 ~]$ srvctl start instance -d racdb -i racdb1<\/p>\n

--\u786e\u8ba4\u5404\u4e2a\u8282\u70b9\u76d1\u542c\u914d\u7f6e\u662f\u5426\u6b63\u786e
\n[oracle@rac1 ~]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 15:45:52<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 15:10:12
\nUptime 0 days 0 hr. 35 min. 39 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"+ASM\" has 1 instance(s).
\nInstance \"+ASM1\", status BLOCKED, has 1 handler(s) for this service...
\nService \"+ASM_XPT\" has 1 instance(s).
\nInstance \"+ASM1\", status BLOCKED, has 1 handler(s) for this service...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nService \"racdb\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 2 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nService \"racdbXDB\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 1 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nService \"racdb_XPT\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 2 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

[oracle@rac2 ~]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 15:45:35<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=rac2)(PORT=1521)))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC2
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 15:11:27
\nUptime 0 days 0 hr. 34 min. 7 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac2.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.154)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.154)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.152)(PORT=1521)))
\nServices Summary...
\nService \"+ASM\" has 1 instance(s).
\nInstance \"+ASM2\", status BLOCKED, has 1 handler(s) for this service...
\nService \"+ASM_XPT\" has 1 instance(s).
\nInstance \"+ASM2\", status BLOCKED, has 1 handler(s) for this service...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nService \"racdb\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 1 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 2 handler(s) for this service...
\nService \"racdbXDB\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 1 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nService \"racdb_XPT\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 1 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 2 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u4f7fcost\u914d\u7f6e\u751f\u6548
\n\u53d6\u6d88\u5404\u4e2a\u8282\u70b9listener.ora\u4e2d\u7684\u6ce8\u91ca\u884c
\nSECURE_REGISTER_LISTENER_RAC1 = (TCP,TCPS)<\/p>\n

--\u9a8c\u8bc1cost
\n--\u53c2\u8003Using Class of Secure Transport (COST) to Restrict Instance Registration [ID 1453883.1]
\n--\u5bf9\u4e8eTCP\u534f\u8bae\u7684\u9a8c\u8bc1\uff08\u53ea\u80fd\u8d70TCP\u534f\u8bae\uff09
\n--\u4fee\u6539\u76d1\u542c\u914d\u7f6e\u6587\u4ef6\uff08\u53ea\u5141\u8bb8TCP\u534f\u8bae\uff09
\n[oracle@rac1 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac1 admin]$ cat listener.ora
\n# listener.ora.rac1 Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora.rac1
\n# Generated by Oracle configuration tools.<\/p>\n

LISTENER_RAC1 =
\n(DESCRIPTION_LIST =
\n(DESCRIPTION =
\n# (ADDRESS = (PROTOCOL = IPC)(KEY = REGISTER))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac1-vip)(PORT = 1523)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.151)(PORT = 1521)(IP = FIRST))
\n)
\n)<\/p>\n

#cost add
\nWALLET_LOCATION =
\n(SOURCE =
\n(METHOD = FILE)
\n(METHOD_DATA =
\n(DIRECTORY = \/opt\/ora10g\/product\/database\/network\/admin\/cost)
\n)
\n)<\/p>\n

#SECURE_REGISTER_LISTENER_RAC1 = (IPC)
\n#SECURE_REGISTER_LISTENER_RAC1 = (TCP,TCPS)<\/p>\n

SID_LIST_LISTENER_RAC1 =
\n(SID_LIST =
\n(SID_DESC =
\n(SID_NAME = PLSExtProc)
\n(ORACLE_HOME = \/opt\/ora10g\/product\/database)
\n(PROGRAM = extproc)
\n)
\n)
\n--\u91cd\u542f\u76d1\u542c\uff0c\u5e76\u67e5\u770b\u6ce8\u518c\u7684\u670d\u52a1\u4fe1\u606f
\n[oracle@rac1 admin]$ lsnrctl reload<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:02:29<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nThe command completed successfully
\n[oracle@rac1 admin]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:02:36<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 22:45:47
\nUptime 0 days 0 hr. 16 min. 49 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u624b\u52a8\u6ce8\u518c\u670d\u52a1\uff0c\u5e76\u67e5\u770b\u76d1\u542c\u6ce8\u518c\u4fe1\u606f
\n[oracle@rac1 admin]$ sqlplus \/nolog<\/p>\n

SQL*Plus: Release 10.2.0.5.0 - Production on Wed Sep 12 23:02:59 2012<\/p>\n

Copyright (c) 1982, 2010, Oracle. All Rights Reserved.<\/p>\n

SQL> conn \/as sysdba
\nConnected.
\nSQL> alter system register;<\/p>\n

System altered.<\/p>\n

SQL> !
\n[oracle@rac1 admin]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:03:15<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 22:45:47
\nUptime 0 days 0 hr. 17 min. 28 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u9a8c\u8bc1\u671f\u95f4\u89c2\u5bdf\u76d1\u542c\u65e5\u5fd7\uff08\u65e0\u62a5\u9519\u53ca\u62d2\u7edd\u6ce8\u518c\u7684\u4fe1\u606f\uff09
\n[oracle@rac1 admin]$ tail -20 \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nTNS-01194: The listener command did not arrive in a secure transport
\n12-SEP-2012 23:02:22 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\nSystem parameter file is \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nLog messages written to \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nTrace information written to \/opt\/ora10g\/product\/database\/network\/trace\/listener_rac1.trc
\nTrace level is currently 0
\n12-SEP-2012 23:02:29 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=reload)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * reload * 0
\n12-SEP-2012 23:02:36 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * status * 0
\n12-SEP-2012 23:03:03 * (CONNECT_DATA=(SERVICE_NAME=racdb1)(CID=(PROGRAM=oracle)(HOST=rac2)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.152)(PORT=25687)) * establish * racdb1 * 12514
\nTNS-12514: TNS:listener does not currently know of service requested in connect descriptor
\n12-SEP-2012 23:03:09 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\n12-SEP-2012 23:03:09 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\n12-SEP-2012 23:03:15 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * status * 0
\n12-SEP-2012 23:03:20 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\n12-SEP-2012 23:03:22 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport<\/p>\n

--\u6ce8\uff1a\u5b9e\u4f8b\u6ce8\u518c\u5931\u8d25\uff0c\u76d1\u542c\u65e5\u5fd7\u51fa\u73b0TNS-01194: The listener command did not arrive in a secure transport
\n--\u5f97\u8bc1<\/p>\n

--\u6062\u590dTCP\u9a8c\u8bc1
\n--\u4fee\u6539\u76d1\u542c\u914d\u7f6e\u6587\u4ef6
\n[oracle@rac1 admin]$ pwd
\n\/opt\/ora10g\/product\/database\/network\/admin
\n[oracle@rac1 admin]$ cat listener.ora
\n# listener.ora.rac1 Network Configuration File: \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora.rac1
\n# Generated by Oracle configuration tools.<\/p>\n

LISTENER_RAC1 =
\n(DESCRIPTION_LIST =
\n(DESCRIPTION =
\n# (ADDRESS = (PROTOCOL = IPC)(KEY = REGISTER))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCPS)(HOST = rac1-vip)(PORT = 1523)(IP = FIRST))
\n(ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.137.151)(PORT = 1521)(IP = FIRST))
\n)
\n)<\/p>\n

#cost add
\nWALLET_LOCATION =
\n(SOURCE =
\n(METHOD = FILE)
\n(METHOD_DATA =
\n(DIRECTORY = \/opt\/ora10g\/product\/database\/network\/admin\/cost)
\n)
\n)<\/p>\n

#SECURE_REGISTER_LISTENER_RAC1 = (IPC)
\nSECURE_REGISTER_LISTENER_RAC1 = (TCP,TCPS)<\/p>\n

SID_LIST_LISTENER_RAC1 =
\n(SID_LIST =
\n(SID_DESC =
\n(SID_NAME = PLSExtProc)
\n(ORACLE_HOME = \/opt\/ora10g\/product\/database)
\n(PROGRAM = extproc)
\n)
\n)
\n--\u91cd\u542f\u76d1\u542c\uff0c\u5e76\u67e5\u770b\u670d\u52a1\u6ce8\u518c\u4fe1\u606f
\n[oracle@rac1 admin]$ lsnrctl reload<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:06:44<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nThe command completed successfully
\n[oracle@rac1 admin]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:06:48<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 22:45:47
\nUptime 0 days 0 hr. 21 min. 1 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u624b\u52a8\u6ce8\u518c\u670d\u52a1\uff0c\u5e76\u67e5\u770b\u76d1\u542c\u6ce8\u518c\u4fe1\u606f
\n[oracle@rac1 admin]$ sqlplus \/nolog<\/p>\n

SQL*Plus: Release 10.2.0.5.0 - Production on Wed Sep 12 23:07:09 2012<\/p>\n

Copyright (c) 1982, 2010, Oracle. All Rights Reserved.<\/p>\n

SQL> conn \/as sysdba
\nConnected.
\nSQL> alter system register;<\/p>\n

System altered.<\/p>\n

SQL> !
\n[oracle@rac1 admin]$ lsnrctl status<\/p>\n

LSNRCTL for Linux: Version 10.2.0.5.0 - Production on 12-SEP-2012 23:07:25<\/p>\n

Copyright (c) 1991, 2010, Oracle. All rights reserved.<\/p>\n

Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
\nSTATUS of the LISTENER
\n------------------------
\nAlias LISTENER_RAC1
\nVersion TNSLSNR for Linux: Version 10.2.0.5.0 - Production
\nStart Date 12-SEP-2012 22:45:47
\nUptime 0 days 0 hr. 21 min. 38 sec
\nTrace Level off
\nSecurity ON: Local OS Authentication
\nSNMP OFF
\nListener Parameter File \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nListener Log File \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nListening Endpoints Summary...
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.153)(PORT=1521)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=192.168.137.153)(PORT=1523)))
\n(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.151)(PORT=1521)))
\nServices Summary...
\nService \"+ASM\" has 1 instance(s).
\nInstance \"+ASM1\", status BLOCKED, has 1 handler(s) for this service...
\nService \"+ASM_XPT\" has 1 instance(s).
\nInstance \"+ASM1\", status BLOCKED, has 1 handler(s) for this service...
\nService \"PLSExtProc\" has 1 instance(s).
\nInstance \"PLSExtProc\", status UNKNOWN, has 1 handler(s) for this service...
\nService \"racdb\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 2 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nService \"racdbXDB\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 1 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nService \"racdb_XPT\" has 2 instance(s).
\nInstance \"racdb1\", status READY, has 2 handler(s) for this service...
\nInstance \"racdb2\", status READY, has 1 handler(s) for this service...
\nThe command completed successfully<\/p>\n

--\u67e5\u770b\u76d1\u542c\u65e5\u5fd7
\n[oracle@rac1 admin]$ tail -20 \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\n12-SEP-2012 23:06:20 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\n12-SEP-2012 23:06:23 * service_register_NSGR * 1194
\nTNS-01194: The listener command did not arrive in a secure transport
\nSystem parameter file is \/opt\/ora10g\/product\/database\/network\/admin\/listener.ora
\nLog messages written to \/opt\/ora10g\/product\/database\/network\/log\/listener_rac1.log
\nTrace information written to \/opt\/ora10g\/product\/database\/network\/trace\/listener_rac1.trc
\nTrace level is currently 0
\n12-SEP-2012 23:06:44 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=reload)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * reload * 0
\n12-SEP-2012 23:06:48 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * status * 0
\n12-SEP-2012 23:07:10 * service_register * racdb1 * 0
\n12-SEP-2012 23:07:10 * service_update * racdb1 * 0
\n12-SEP-2012 23:07:10 * service_register * racdb1 * 0
\n12-SEP-2012 23:07:20 * service_update * racdb1 * 0
\n12-SEP-2012 23:07:20 * service_update * racdb1 * 0
\n12-SEP-2012 23:07:20 * service_register * +ASM1 * 0
\n12-SEP-2012 23:07:23 * service_register * racdb2 * 0
\n12-SEP-2012 23:07:25 * (CONNECT_DATA=(CID=(PROGRAM=)(HOST=rac1)(USER=oracle))(COMMAND=status)(ARGUMENTS=64)(SERVICE=LISTENER)(VERSION=169870592)) * status * 0
\n12-SEP-2012 23:08:04 * (CONNECT_DATA=(SERVICE_NAME=racdb1)(CID=(PROGRAM=oracle)(HOST=rac2)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.137.152)(PORT=25710)) * establish * racdb1 * 12514
\nTNS-12514: TNS:listener does not currently know of service requested in connect descriptor<\/p>\n

--\u6ce8\uff1a\u76d1\u542c\u6062\u590d\u6b63\u5e38\u3002
\n--\u5f97\u8bc1<\/p>\n","protected":false},"excerpt":{"rendered":"

ORALCE\u5b89\u5168\u4e4bRAC\u914d\u7f6eClass of Secure Transport(COST) –\u53c2\u7167\u6587\u6863 — […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[35],"tags":[],"_links":{"self":[{"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/posts\/287"}],"collection":[{"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=287"}],"version-history":[{"count":5,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions"}],"predecessor-version":[{"id":652,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=\/wp\/v2\/posts\/287\/revisions\/652"}],"wp:attachment":[{"href":"http:\/\/www.yallonking.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=287"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.yallonking.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}