Re: securing Oracle tnslistener on firewall.

On 6 Dec 2005 16:03:01 -0000, mjohn2000_99@yahoo.com<mjohn2000_99@yahoo.com> 
wrote:> Hello friends,> My oracle people tell me to open up all TCP high ports 
to allow SQL communication. I see a security issue there because it would open 
up about 60K ports.>> My test shows that the only port used by TNS listener is 
1521. But, oracle people claim that when there is need for many connections, 
oracle would spawn more dedicated process for each connection and redirect 
connections to random high ports. My research showed that claim is correct. 
But, it is a risky thing to open up too many ports.>> Please advise me how I 
can make the SQL communication secure. If u know any article explain the 
security, please point me on that direction.>> Thank you….> John>
I may be off the mark here, because I haven't yet had the time tostudy the 
subject, but we're running into a similar problem aroundhere. Rumor has it that 
Oracle likes to open up random ports after youfirst connect on 1521. Again, I 
haven't substantiated it in theirdocumentation, but Oracle does provide a 
proxy, called "connectionmanager" or "cman", designed to make Oracle operable 
in worlds wherepeople are silly enough to think they need outlandish 
protectionmeasures like firewalls <*smirk*>
The Oracle documentation comes with something like a NetworkArchitecture 
document that I intend to read to help fix our problem.Perhaps it will answer 
questions for you as well.
-Josh