How do you secure listener?
In the Oracle architecture, the Listener is the front door to your database. It is the first thing a client hits when they try to connect. If your listener is unsecured, an attacker can perform "denial of service" attacks, redirect traffic to a malicious server, or even gain information about your database version and SID.
Securing the listener is one of the most important (yet often overlooked) steps in hardening an Oracle environment.
Why would someone attack a listener?
Redirection: Tricking the listener into sending users to a fake database to steal passwords.
Information Gathering: Using the STATUS or SERVICES commands to learn the database's internal names.
Service Registration Hijacking: Registering a rogue database instance with your listener to intercept data.
In older versions, anyone could connect to your listener remotely and shut it down. Modern versions have changed the defaults, but you should explicitly ensure that the listener only listens to administration commands from the local server.
How: By default, modern listeners use Local OS Authentication. Ensure you are not using a listener.ora password, as those are easily cracked. Rely on OS-level permissions instead.
Standard "TCP" communication is plain text. To truly secure the listener, you should use TCPS (TCP over SSL/TLS).
Benefit: This encrypts the initial "handshake" between the client and the listener, ensuring that SIDs and usernames aren't sniffed off the wire during the connection phase.
One of the most dangerous vulnerabilities is Registration Hijacking. By default, a listener will accept a registration request from any database.
The Solution: Use COST (Class of Service Training). This requires the database to provide a "registration password" or be on a "valid node list" before the listener will acknowledge it.
The Parameter: SECURE_REGISTER_listener_name = (TCP) in your listener.ora.
You can tell the listener exactly which IP addresses are allowed to connect. This acts as a built-in firewall at the database level.
In sqlnet.ora:
tcp.validnode_checking = yes
tcp.invited_nodes = (192.168.1.10, 192.168.1.11, 10.0.0.5)
# Or use tcp.excluded_nodes to block specific IPs
Check your listener.ora for these security settings:
| Parameter | Recommended Setting | Why? |
| ADMIN_RESTRICTIONS | ON | Prevents runtime modification of listener settings via LSNRCTL. |
| LOGGING | ON | Essential for auditing who is trying to connect (and who is failing). |
| SECURE_CONTROL | (TCP) | Forces the use of local OS authentication for administration. |
Many security "scanners" look for port 1521. While changing the port to something like 1555 won't stop a determined hacker, it stops 99% of automated "bot" attacks and keeps your logs cleaner.
Set ADMIN_RESTRICTIONS_LISTENER = ON in listener.ora.
Enable Logging to monitor for "TNS-Poison" or "Service Registration" attacks.
Use Valid Node Checking to restrict access to known Application Servers only.
Secure the OS: Ensure the listener.ora and sqlnet.ora files are owned by oracle and have 600 permissions.
The listener is the "receptionist" of your database. You wouldn't want your receptionist giving out sensitive directions or letting random strangers into the building without an ID check. By hardening the listener, you ensure that the very first point of contact is just as secure as the data itself.