Security dudes.

Question

Hi, i read the article hacking_and_hardening_oracle_XE and said:
Instead of changing the SID you could also block the incoming requests on port 1521
Block all ports (e.g. 1521) except of the http port (e.g. 80 or 8080) with the Windows Firewall or Linux Firewall
..., if a local area network port that is blocked, it will work to access the database using desktop applications created in MS Visual Studio or Java?
Roberto

Answer 1

No, desktop applications will fail.
In internet-facing environments, there's no need to leave port 1521 open - visitors only need to access the webserver on whatever port it is listening e.g. port 8080. Leaving port 1521 open only makes the attack surface bigger. Not good.
In such environments, an even more sensible approach would be to disable remote access altogether and configure Apache to reverse proxy only the /apex/ DAD in the Embedded PL/SQL Gateway as described Re: APEX charts and reverse proxy (Houston we have a problem!!). I personally use an Apache reverse proxy in the intranet as well - this way I can cache the images directory (/i/) used by APEX in the file system. This id my xe.conf file:
ProxyRequests Off
SetEnv force-proxy-request-1.0.1
SetEnv proxy-nokeepalive 1
ProxyPass        /apex http://localhost:8080/apex
ProxyPassReverse /apex http://localhost:8080/apex
Alias /i/ /usr/lib/oracle/xe/apex/images/
<Directory "/usr/lib/oracle/xe/apex/images/">
  AllowOverride none
  Order allow,deny
  Allow from all
  <IfModule mod_expires.c>
    ExpiresActive on
    ExpiresDefault "access plus 1 month"
  </IfModule>
  IndexOptions FancyIndexing
</Directory>
AddType text/xml         .xbl
AddType text/x-component .htcIn short, keep port 1521 open in internal servers.
Georger
rober584812 wrote:
Hi, i read the article hacking_and_hardening_oracle_XE and said:
Instead of changing the SID you could also block the incoming requests on port 1521
Block all ports (e.g. 1521) except of the http port (e.g. 80 or 8080) with the Windows Firewall or Linux Firewall
..., if a local area network port that is blocked, it will work to access the database using desktop applications created in MS Visual Studio or Java?
Roberto