How to Block / Hardening of "Unused Ports" in OracleAS-10gAS

Hi All,
I have installed Oracle 10gAS PatchSet-2 9.0.4.2.0 and Windows-2000 SP-4 OS. The Both instances (INFRA & Mid-Tier) are installed on same box. My AS is working fine and all components are working great.
+
I can find-out the ports being used/configured by 10gAS of this installation. Rest all other Ports are open as such on this OS and are not being used. So basically i want to "Block all those Unused Ports of this 10gAS installation"
1. Is it Possible..? If Yes! how to start about this.
2. Does Oracle Provide a Documentation on this or the details of this is included anywhere in any of the Docs.?
This has been pointed out by one of our Corporate Auditors who has audited our entire IT Infrastructure setup and given us that comment. Can anybody would help me in this regard or suggest me tips / docs. which could be useful to me. Looking for ur help.
Regards,
Kamesh Rastogi

Hello,
I would clarify what i need and intend to do......
Let say my HTTP Server is configured and listening at port 7779 & 7778. And the range of this is 7777 - 7999 as provided by App.Serevr.
SO i want to block all the ports of above range and ONLY want to open or allow requests coming for Port No. 7779 or 7778.
What all is being used by App.Server is know to us and we can find it out and list it....but how to block them...here in App.Server.
Regards,
Kamesh Rastogi

Similar Messages

How to block my iphone5?

how to block my iphone5?

Lost? Stolen?
The only way to locate/disable/erase any lost/stolen iPhone/iPod Touch is through Find My Phone or a similar app. However, this requires that Find My Phone be setup/activated, on your phone, before it was lost/stolen. You would then login at iCloud.com & try to locate it. This requires the phone be turned on & have an Internet connection. There is no other way to locate a lost/stolen iPhone. Apple can't/won't help you, nor will your carrier. Report the loss to the Police, your carrier & Insurance company. Change all of your passwords, especially your Apple ID/iCloud password NOW!
If your carrier offers Blacklisting & they Blacklist the phone, it will be unusable as a phone.
If locked with a passcode, and running iOS 7.0, then phone cannot be activated or the passcode removed without knowing your Apple iD/Password. It will be nothing but a useless paperweight.
If not running iOS 7.0, the phone can be forced into recovery mode & restored.

CME:how to block external call to external call

cme have the four fxo and AA,when the external calls come in,and dial 9+ pstn num,it can call from external call to another external call,how can blocking?

Hi,
try to use this command
#call application voice aa max-extension-length 5
This option declares the maximum length of the extension that the user can dial when dial-by-extension-option is chosen. The default value is 5. The value can be 0 with no restriction up to x digits.
or try
3.
Configure Class of Restriction (COR) to block call transfers from B-ACD to PSTN numbers. The sample configuration below prevents the B-ACD from transferring calls out to local and long distance PSTN numbers. The B-ACD can still transfer calls to internal extensions.
Below is an example of such a configuration:
dial-peer cor custom
name longdistance
name local
dial-peer cor list call-longdistance
member longdistance
dial-peer cor list call-local
member local
dial-peer cor list block-pstn
dial-peer voice 1 voip
corlist incoming block-pstn
application aa
destination-pattern 1000
session target ipv4:192.168.1.1
incoming called-number 1000
dtmf-relay h245-alphanumeric
codec g711ulaw
no vad
dial-peer voice 2 pots
corlist outgoing call-longdistance
destination-pattern 91..........
port 0/2/0
dial-peer voice 3 pots
corlist outgoing call-local
destination-pattern 9[2-9]......
port 0/2/0
Thanks
Najeeb

Use CW to shutdown unused ports?

Is there a way to have CW (LMS 3.2) shutdown ports that have been inactive for X number of days? I know Campus Manager has the "Reclaim Unused ports UP" where I can enter a number of days and it will give me a list of all the ports that have been unused and are in Admin status of UP, but I'd like to apply that report to shutting down those ports.
Any thoughts?
I could run the above mentioned report and then create a netconfig job for each switch, but that could get annoying if I have to do a large number of switches.
In regards to the reports from Campus manager, is that data gathered from the periodic data collections? How can I tell if CM was able to successfully collect the data?
Appreciate any help. Thanks!

No, Campus Manager cannot automatically shutdown unused up ports. Doing a Netconfig job would work, but as you said, it could get tedious. The data for these reports is built from User Tracking acquisition data. You can always check to see if an acquisition completed, but checking the Campus Manager homepage. Check the last completion date, and make sure it corresponds with a recently scheduled UT acquisition.

How to block yahoo new messenger option in mail beta

Hi,
Anyone know how to block yahoo's new option of messenger being in the
yahoo mail beta? I know we could just block access to yahoo mail, but
that hasn't been a real problem at this point (according to our logs
anyway) but now that messenger has been added there, it certainly could
become a problem.
Have already blocked webmessenger for yahoo and msn, are there others
now? we have the other general blocks for the clients (port
redirections etc)
Thank you,
Mike

Mike,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

How to Block send e-mail by telnet using Exchange 2010

Hi
I have Exchange 2010 SP3 server (Edge and Database servers).
When i logon to exchange server: telnet mail.domain.com 25using commands:
mail from:[email protected]
rcpt to:[email protected]
I can send e-mails without password.
How to block it? What is wrong with this server settings?
Kind Regards Tomasz

you can change the receive connector that is listening on port 25 to require authentication removing the anonymous the problem will be every server that sends you email will need to have a password on your server so you will not receive email
form anyone unless they have the password configured if you only want to receive email on this server from another trusted server than this is how you do it, otherwise you need to leave anonymous access enabled. Spam appliances sometimes will be the only server
allowed to send to your exchange server, but the spam appliance will have anonymous access allowed on port 25 so it can get the email. Typically the distribution of port 25 traffic is handled at the firewall and it's either sending port 25 traffic to
your email server or a spam appliance.

How to block Sql Plus sessions in Oracle 10g

Hi,
I want to block all sql plus sessions in oracle 10g, as we have a application and we need each and every one to use this application not the sql plus session.
Kindly update us as soon as possible. and also thanks in advanced.

Understand the concept Karl, but a layered defense seldom works in the IP world. If I manage to get through the firewall, then how can you prevent me access, at IP level, at any other ISO stack layer? If you manage to get through, then your firewall policies could just be too weak :) at least you must have some kind of an IDS infrastructure in place..
what I mean is, you can have infinite number of threats.. and this will be part of your Risk Analysis. Determining all possible threats to the assets, what are being protected and their associated value, and predicting the rate of occurrence.... with all of these you could probably come up with contingency plans and incident response.. And most of all, you should not ignore the fact that people are creative, ingenious, and curious, and they'll prove this to you by testing your security implementations. So you'll have to periodically evaluate your security.. that's why there are audits.. Also, you must balance Security, Performance, Usability, and your Budget.
Yes, you can argue that if the entire firewall goes down (thus no IP defense), then something like DBV (or even denying IPs in sqlnet) can provide some defense. But is that not then a case of too little too late? It's better too little too late, than no protection at all... Imagine if there's no DBV, or if you have not implemented the concept of "Least Privilege"? or if the backups and exports are not encrypted? That would be more devastating.. that's the importance of database security options and features in providing "defense in depth"
I question just what purpose and how effective IP packet security is at higher layers. It can never substitute doing this instead at firewall level. Well, it's not all about network security. All facets must be considered and the inter-relationships should be understand. Like the core information security and access management, physical and personnel security, training them, etc... And all of these are equally important in providing a secure ecosystem
As for security that relies on the client to pass secure data (like executable name or o/s user name)... all this can easily be spoofed. Even if the app and Oracle driver are somehow digitally signed and these signatures can be verified on the server side, we only need to look at Vista to see how secure this really would be. Microsoft attempted to encrypt every single h/w and s/w layer from the physical DVD track to the pixel on the monitor.. and this was defeated. And this was done as o/s kernel level. It is less complex to hack at driver level and even trivial to do it at application level.Security is about risk management. Blocking SQL*Plus does not negate the risk of SQL from the wild being run on a production server. For example, the client is a VB client using ODBC. It is easy to create a proxy that accepts the ODBC connection from the VB client and proxy the OCI packets to the real Oracle server. Now you have a man-in-the-middle than can inspect every single SQL call made to Oracle, and inject any PL/SQL or SQL code it wants.
Security is far beyond writing a login trigger to deny SQL*Plus sessions and calling that a defense. >
Yes I agree with you. That's why there are independent organizations and regulating bodies that provides security best practices, to give us a headstart on comming up of strong security policies.
And one of my favorites is the one provided by IASE (sponsored by Defense Information Systems Agency) where there's lot of content regarding hardening and policies
http://iase.disa.mil/stigs/stig/index.html
http://iase.disa.mil/stigs/checklist/index.html
http://iase.disa.mil/stigs/SRR/index.html
- Karl Arao
http://karlarao.wordpress.com

How to block on account payment for certain user

Dear All,
   We are looking to implement a policy on how to block certain users not to be able to take on account payment. One more query is it possible to disable a field. I want to disable the field "Payment on account" in the Incoming Payments. Please advice

Hi,
Sue below code in transaction notification procedure,Change userid =1 to user id for user ou want to block payment on account
IF @Object_type = N'24' and @transaction_type = N'A'
BEGIN
if exists (SELECT    ORCT.DocEntry from ORCT
                     WHERE (ORCT.PayNoDoc='Y' and ORCT.UserSign=1) and ORCT.DocEntry = @list_of_cols_val_tab_del
begin
        select @error =14
   select @error_message = 'Cannot make on account payments '
end
END
Thanks,
Neetu

How to block the " you are lucky visitor" popup each time I open the Firefox. I can not find any information in the add on lists et al. Thanks!

Recently, my Firefox browser v25.0 is experiencing a popup problem. A popup message saying "... you are today's luck visotor, please click Ok to ontinue". I have to click Ok then I can continue to use the browser. Is this a popular problem? Please advise how to block this popup. Thanks!

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.
You can try these free programs to scan for malware, which work with your existing antivirus software:
* [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner]
* [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware]
* [http://support.kaspersky.com/faq/?qid=208283363 TDSSKiller - AntiRootkit Utility]
* [http://www.surfright.nl/en/hitmanpro/ Hitman Pro]
* [http://www.eset.com/us/online-scanner/ ESET Online Scanner]
[http://windows.microsoft.com/MSE Microsoft Security Essentials] is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.
Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article.
Did this fix your problems? Please report back to us!

How to change the default apex port

hi,
i am installed apex4.0 in EBS R12 DB with HTTP Server method. my apex is running from application server 10g and default port is 7777.
URl: http://hostname:7777/pls/apex
My EBS R12 running on http://hostname:8007.
is it possible to change the apex port to EBS Apache port(8007) in R12 and finally i want to change above URL like this
Before change : http://hostname:7777/pls/apex
After Change : http://hostname:8007/pls/apex
Thanks in advanace....

How to Change the Default SSH Port from Terminal ?
now showing default SSH Port 22 i need change it pls help me how can do

How To Block a User From Changing Total Field In AR Invoice

Hi all,
I would like to find out how to block a user from being able to change the total field at the bottom right hand side of the AR Invoice. Currently if a user creates an invoice and is still busy in that invoice they can adjust the total field which in turn will update the discount field as well.
Is this simply an authorization issue or am I going to have to do it in the transaction notification?
We are using SAP Business One PL 30 currently.

Hi
Please review by note again -This is by system design .
I don't know why you are so worried abt this because by setting up discount max ,if user cannot post the document ,that means it is not in the system ,no matter they change multiple times in the fields .
But I think your scenario is different ,
You are copying with certain discount from Delivery to AR invoice and i think you don't want user to change the discount field , then you can solve your issue by using approval or sp_notification
If you really want it to be greyed out ,I think you might have to go through by SDK or Boyum addon.
Thank you
Bishal

How to Change the Default SSH Port from Terminal ?

How to Change the Default SSH Port from Terminal ?

How to Change the Default SSH Port from Terminal ?
now showing default SSH Port 22 i need change it pls help me how can do

How to Change the Default SSH Port from Terminal ? now showing default SSH Port 22 i need change it pls help me how can do

How to Change the Default SSH Port from Terminal ?
now showing default SSH Port 22 i need change it pls help me how can do

How to Change the Default SSH Port from Terminal ?
now showing default SSH Port 22 i need change it pls help me how can do

How to enable the S-Video port on a Satelite M30X-154?

Hey does any one know how to enable the S-Video port on a Satellite SM30X-154 laptop?
If I press the FN+5 keys the only options I get is LCD and no S-VHS option. My TV is set up for it as I watch DVD's through the cable.
When I connect the cable to the laptop, nothing happens!!
HELP

Hi,
Sorry, my Tosh A100 has a Geforce 7600, I don't know what your GA is.
But on mine I have a NVidia Control Panel, where I can configure dualview,
which normally lets me choose between the builtin LCD and the extern monitor (VGA-Port).
When a TV is connected and not recognized, I can enforce recognition there.
On the next start of the panel, the TV is then available too.
Perhaps I could help you.
If not, note that with windows settings your TV will not be available.
Try to go to the User Interface of your graphics adapter...
Matz

How can I split the video port of an older Mac Mini so I can use both the 922-6199 DVI to RCA, S-Video Adapter and a Cinema Display?

How can I split the video port of an older Mac Mini so I can use both the 922-6199 DVI to RCA, S-Video Adapter and a Cinema Display?

Which exact Mini?
At the Apple Icon at top left>About this Mac.
Then click on More Info>Hardware and report this upto but not including the Serial#...
Hardware Overview:
Model Name: iMac
Model Identifier: iMac7,1
Processor Name: Intel Core 2 Duo
Processor Speed: 2.4 GHz
Number Of Processors: 1
Total Number Of Cores: 2
L2 Cache: 4 MB
Memory: 6 GB
Bus Speed: 800 MHz
Boot ROM Version: IM71.007A.B03
SMC Version (system): 1.21f4

How to Block / Hardening of "Unused Ports" in OracleAS-10gAS

Similar Messages

Maybe you are looking for