VNCR (Valid Node Checking for Registration), as an alternative for COST, CVE-2012-1675, a real life story.

Recently recommended VNCR (Valid Node Checking for Registration) for a customer RAC environment which was affected by Oracle Security Alert named CVE-2012-1675.

Reference:

• https://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html

The vulnerability was identified as the TNS listening poisioning, and the Oracle's suggestion was to use Class of Secure Transport (COST) to restrict instance registration.

Reference: 

• Using Class of Secure Transport (COST) to Restrict Instance Registration in Oracle RAC (Doc ID 1340831.1)

However, we wanted to have a quick solution and at that moment; I recommended using the VNCR to restrict the nodes which can be registered to the RAC listeners (local and scan listeners)

This way; listeners will be able to prevent the remote instances and remote codes to register, thus we can protect the system indirectly at a certain level, without implementing the COST.

References:

• How to Enable VNCR on RAC Database to Register only Local Instances (Doc ID 1914282.1) 
• Valid Node Checking For Registration (VNCR) (Doc ID 1600630.1)

The implementation of VNCR was simple.. We just added the following lines to the listener ora files. (In this RAC environment, both Scan and local listeners were using the same listener.ora files, which were located in GRID Home, as recommended for RAC instances >= 11gR2)

VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN1=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN2=ON
VALID_NODE_CHECKING_REGISTRATION_LISTENER_SCAN3=ON
REGISTRATION_INVITED_NODES_LISTENER_SCAN1=(<Node1'spubichostname>,<Node2pubichostname>)
REGISTRATION_INVITED_NODES_LISTENER_SCAN2=(<Node1'spubichostname>,<Node2pubichostname>)
REGISTRATION_INVITED_NODES_LISTENER_SCAN3=(<Node1'spubichostname>,<Node2pubichostname>)

Note that,  In RAC, remote listeners should be registered by all the RAC nodes, but the local listeners should be registered only by their local nodes.. 

So we didn't declared any invited nodes for Local listener, as we wanted local listeners to be registered only from the local nodes. 

(Setting VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON is enough for that..!)

After adding the lines (seen above) to the listener.ora files, we restarted the scan and local listeners and that's it. (we could actually reload the scan and local listeners)

Following is a proof for VNCR. It is working..

Here, I m implementing the VNCR in the remote listener(scan), which is running on Node 1. Note that, I m not adding Node 2 to the invited nodes list. As a result, only node 1 can register the scan listener, as you see below,  ->

[oracle@erm01 admin]$ lsnrctl status LISTENER_SCAN2

LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 03-MAR-2017 08:38:38
Copyright (c) 1991, 2013, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN2)))
STATUS of the LISTENER
------------------------
Alias LISTENER_SCAN2
Version TNSLSNR for Linux: Version 11.2.0.4.0 - Production
Start Date 03-MAR-2017 08:38:01
Uptime 0 days 0 hr. 0 min. 37 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=LISTENER_SCAN2)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=11.11.11.211)(PORT=1521)))
Services Summary...
Service "ERM" has 1 instance(s).
Instance "ERM1", status READY, has 1 handler(s) for this service...
Service "ermXDB" has 1 instance(s).
Instance "ERM1", status READY, has 1 handler(s) for this service...

The command completed successfully

Here I set the invitied nodes for adding the node 2 to the invited nodes list, and now I see the instance in node2 is registed to the LISTENER_SCAN2 , as well ->

[oracle@erm01 admin]$ lsnrctl status LISTENER_SCAN2

LSNRCTL for Linux: Version 11.2.0.4.0 - Production on 03-MAR-2017 08:37:33

Copyright (c) 1991, 2013, Oracle.  All rights reserved.

 Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=LISTENER_SCAN2)))

STATUS of the LISTENER

------------------------

Alias                     LISTENER_SCAN2

Version                   TNSLSNR for Linux: Version 11.2.0.4.0 - Production

Start Date                03-MAR-2017 08:36:38

Uptime                    0 days 0 hr. 0 min. 54 sec

Trace Level               off

Security                  ON: Local OS Authentication

SNMP                      OFF

  (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=LISTENER_SCAN2)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=11.11.11.211)(PORT=1521)))

Services Summary...

Service "ERM" has 2 instance(s).

  Instance "ERM1", status READY, has 1 handler(s) for this service...

  Instance "ERM2", status READY, has 1 handler(s) for this service...

Service "ermXDB" has 2 instance(s).

  Instance "ERM1", status READY, has 1 handler(s) for this service...

  Instance "ERM2", status READY, has 1 handler(s) for this service...

The command completed successfully

Well, this is the story of the day guys :). I just did this configuration 2 hours ago and here I m writing it :) I hope you will find it useful.