Setup VNCR in Oracle RAC

This post is also available in: Português

Enabling VNCR (Valid Node Checking for Registration) is a mandatory task that every DBA should do when terminates the configuration of a new database, being it a Single Instance or a Oracle RAC. In my opinion, Oracle should have already defined this option enabled by default on new releases.

In times of TNS Poison (Oracle Security Alert CVE-2012-1675), which reaches "any" version of Oracle to the most current (12c), we can not risk that a compromised computer inside the network of eventually making a man-in-the-middle attack. So, in this article, I'll show you how to activate this protection in a RAC.

Remembering that VNCR is only available in versions 11g (after PS 11.2.0.4) and 12c. In other versions, this protection may be done using an Oracle feature called COST (Class of Secure Transport). If you run a version of DB lower than 10.2.0.4, there is no Oracle tool and the best form of protection is via firewall (iptables, etc).

For more information about COST, MOS provides step by step guides of how to enable it:

• Using Class of Secure Transport (COST) to Restrict Instance Registration (Doc ID 1453883.1)
• Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC (Doc ID 1340831.1)

(In both cases, you must apply the patch for Bug 12880299)

Let's start. In our scenario, we are in a 4 nodes Oracle RAC: oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004.

We will need to edit the listener.ora file inside GRID_HOME of all 4 servers. The path to the file can be obtained by running "lsnrctl status":

[oracle@oracbddrjs001 ~]$ lsnrctl status
...
Listener Parameter File /u01/app/11.2.4/grid/network/admin/listener.ora
...
[oracle@oracbddrjs001 ~]$

Checking the current content, we have:

[oracle@oracbddrjs001 ~]$ cat /u01/app/11.2.4/grid/network/admin/listener.ora
LISTENER=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER)))) # line added by Agent
LISTENER_SCAN1=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN1)))) # line added by Agent
LISTENER_SCAN2=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN2)))) # line added by Agent
LISTENER_SCAN3=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN3)))) # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN1=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN2=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN3=ON # line added by Agent
[oracle@oracbddrjs001 ~]$

What we need to do is to add in each of the 4 listeners (1 local and 3 scans) the parameter VALID_NODE_CHECKING_REGISTRATION_listener_name=ON.
Thus, we add:

VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN2=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN3=ON

The ON value permits that only locally originated registration requests are accepted. Therefore, to allow SCAN_LISTENERS accept requests from other nodes in the cluster, we must include an exception list of nodes allowed:

REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)
REGISTRATION_INVITED_NODES_LISTENER_SCAN2=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)
REGISTRATION_INVITED_NODES_LISTENER_SCAN3=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)

PS: Note that we need to include here the name of the corresponding hostname for the public interface.

With those changes, we will have the listeners of our servers as follows:

[oracle@oracbddrjs001 ~]$ cat /u01/app/11.2.4/grid/network/admin/listener.ora
LISTENER=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER)))) # line added by Agent
LISTENER_SCAN1=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN1)))) # line added by Agent
LISTENER_SCAN2=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN2)))) # line added by Agent
LISTENER_SCAN3=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN3)))) # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN1=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN2=ON # line added by Agent
ENABLE_GLOBAL_DYNAMIC_ENDPOINT_LISTENER_SCAN3=ON # line added by Agent
# Enable VNCR
VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN2=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN3=ON
REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)
REGISTRATION_INVITED_NODES_LISTENER_SCAN2=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)
REGISTRATION_INVITED_NODES_LISTENER_SCAN3=(oracbddrjs001,oracbddrjs002,oracbddrjs003,oracbddrjs004)
[oracle@oracbddrjs001 ~]$

Another way that could also have been utilized would be changing the 3 parameters VALID_NODE_CHECKING_REGISTRATION_listener_name of SCAN LISTENER to SUBNET. This would make unnecessary the use of REGISTRATION_INVITED_NODES_listener_name parameter.

However, I do not recommend this approach because depending on the amount of servers that exist in the subnet of your cluster, you could put it at risk if any of these servers were compromised. The disadvantage of not using the value SUBNET is that whenever a new node is added to the cluster, all listener.ora may be changed including the new host.

Following are the possible values ​​for the variables of the VNC, according to the MOS Oracle Net 12c: Valid Node Checking For Registration (VNCR) (Doc ID 1600630.1)

VALID_NODE_CHECKING_REGISTRATION_listener_name
Values:
OFF/0 - Disable VNCR
ON/1/LOCAL - The default. Enable VNCR. All local machine IPs can register.
SUBNET/2 - All machines in the subnet are allowed registration.

REGISTRATION_INVITED_NODES_listener_name
Values are valid IPs, valid hosts, a subnet using CIDR notation (for ip4/6), or wildcard (*) for ipv4. For example: REGISTRATION_INVITED_NODES_Listener=(net-vm1, 127.98.45.209, 127.42.5.*)

Note that when an INVITED list is set, it will automatically include the machine's local IP in the list. There is no need to include it.

REGISTRATION_EXCLUDED_NODES_listener_name - the inverse of INVITED_NODES.

Finally, reload all listeners (on each node) to activate the changes made in listener.ora:

Check which are running:

[grid@oracbddrjs001 ~]$ lsnrctl status LISTENER
[grid@oracbddrjs001 ~]$ lsnrctl status LISTENER_SCAN1
[grid@oracbddrjs001 ~]$ lsnrctl status LISTENER_SCAN2
[grid@oracbddrjs001 ~]$ lsnrctl status LISTENER_SCAN3

For those who are running, do the reload:

[grid@oracbddrjs001 ~]$ lsnrctl reload LISTENER
[grid@oracbddrjs001 ~]$ lsnrctl reload LISTENER_SCAN3

Okay, now we are with our Oracle RAC protected from SQL Poison attacks.

+16