For security reasons, we'd like to limit an oracle user to only connect from a specific IP address. Is this possible?
If so, how can we configure this?
+2
A:
I would recommend that you use your firewall for this purpose. If you're on Linux, it should be possible to use iptables to setup a rule so that only one specific IP-address can access the ports that Oracle is listening on.
Ola Bini
2009-02-09 12:45:34
This isn't an answer. "limiting all oracle activity to one IP" is not the same as "limit connections to oracle using a specific username to one IP"
jj33
2009-02-09 13:39:20
Guy's right though. Building network security into the application level is not right. It could conceivably be argued for as defense in depth, but then if we're going to start replicating external functionality in our application why not just go whole hog and embed our own networking stack?
JosefAssad
2009-02-09 17:39:15
Is it bad form to comment twice? Pre-emptive apologies...If someone asks how precisely the cart can be made to pull the horse, answering the question directly doesn't really add much value I'd say.
JosefAssad
2009-02-09 17:41:24
This doesn't help .. I want one user (with ~admin privileges) to be bound to one machine, while query users can connect from anywhere.
IronGoofy
2009-02-09 17:58:32
JosefAssad, the difference is that there's very good reason to embed it in the app stack. Yes, of course you limit the incoming IPs that can connect to oracle. And in addition you limit specific IPs to specific usernames, which will add to the security, not replace it - belt and suspenders.
jj33
2009-02-09 20:57:20
jj33 I suppose I could see it that way. It isn't inconceivable that an app might be configured to be picky for example about which IP it permits which rights. I think my position therefore is, don't do it unless you've thought it through and still think you ought to. :)
JosefAssad
2009-02-10 18:44:04
+6
A:
Put a:
SELECT SYS_CONTEXT('USERENV', 'IP_ADDRESS') FROM dual;
into your AFTER LOGON trigger and throw an exception when it's not allowed.
Quassnoi
2009-02-09 13:23:01
+1
A:
Oracle Connection Manager should be available from your installation and acts as a proxy server for SQL*Net - you can configure firewall-like rules for connections with it.
dpbradley
2009-02-09 17:13:55