DataGuard环境下使用TDE透明加密:
开启TDE:
1.创建一个新目录,并指定为wallet目录
$ mkdir -p /oracle/wallet
并设置wallet目录,方法很简单,编辑参数文件sqlnet.ora即可:
$ vi $ORACLE_HOME/network/admin/sqlnet.ora
加入以下信息,保存。
ENCRYPTION_WALLET_LOCATION=
(SOURCE=
(METHOD=file)
(METHOD_DATA=
(DIRECTORY=/oracle/wallet)
)
)
ENCRYPTION_WALLET_LOCATION参数的作用就是告知Wallet的实现方式和物理位置。
上述示例中将/oracle/wallet目录作为Master Key的存放位置。
2.创建master key文件,指定wallet密码
使用SYS用户登陆,通过以下命令建立加密文件:
SQL> alter system set encryption key identified by "123456";
其中,123456为wallet密码。Oracle Wallet是一个可以打开关闭的功能组件,设置密码之后,只有通过密码口令可以启用wallet功能。
此时,在设置的目录下会多出一个ewallet.p12文件。这就是生成的master key文件。
3.启动和关闭Wallet
启动Wallet:
SQL> alter system set encryption wallet open identified by "123456";
关闭Wallet并查看:
SQL> alter system set encryption wallet close identified by "123456";
select * from v$encryption_wallet;
WRL_TYPE WRL_PARAME STATUS
-------------------- ---------- ------------------
file /oracle/wallet OPEN
4.主库切换日志,观察备库警告日志:
内容:
Media Recovery Log /oracle/arch/1_11_1065273402.dbf
Apply redo for TSE master key re-key failed: wallet error 28365
Errors with log /oracle/arch/1_11_1065273402.dbf
MRP0: Background Media Recovery terminated with error 28365
Archived Log entry 12 added for thread 1 sequence 14 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_31775.trc:
ORA-28365: wallet is not open
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 15 dbid 1593054136 branch 1065273402
Recovery interrupted!
Recovered data files to a consistent state at change 967568
Tue Feb 23 14:00:33 2021
MRP0: Background Media Recovery process shutdown (orcl)
5.拷贝钱包相关文件至备库并在主备库查询钱包信息:
主库:
select * from v$encryption_wallet;
WRL_TYPE WRL_PARAME STATUS
-------------------- ---------- ------------------
file /oracle/wallet OPEN
备库:
select * from v$encryption_wallet;
WRL_TYPE WRL_PARAME STATUS
-------------------- ---------- ------------------
file /oracle/wallet CLOSED
启动Wallet:
SQL> alter system set encryption wallet open identified by "123456";
select * from v$encryption_wallet;
WRL_TYPE WRL_PARAME STATUS
-------------------- ---------- ------------------
file /oracle/wallet OPEN
备库开启MRP日志应用:
Media Recovery Waiting for thread 1 sequence 17 (in transit)
Tue Feb 23 14:06:48 2021
Archived Log entry 15 added for thread 1 sequence 17 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 18 dbid 1593054136 branch 1065273402
Tue Feb 23 14:06:52 2021
Media Recovery Log /oracle/arch/1_17_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 18 (in transit)
Tue Feb 23 14:08:16 2021
Archived Log entry 16 added for thread 1 sequence 18 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 19 dbid 1593054136 branch 1065273402
Tue Feb 23 14:08:18 2021
Media Recovery Log /oracle/arch/1_18_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 19 (in transit)
DG日志应用正常.
如果此时主库重建key,那么备库必须重建.
参考文档:
https://www.eygle.com/archives/2020/07/oracle_faq_tde_.html
Mos:
2512024.1
例如:
先同步DG,之后在主库创建钱包并拷贝至备库,在备库打开钱包,此时可以应用.
在主库重建一个钱包,
SQL> alter system set encryption key identified by "123456";
查询主备库主密钥:
mkstore -wrl /oracle/wallet -viewEntry ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
AUL9pyEcvE8lv3uKTzU0TxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
主库:
alter system set encryption wallet close identified by "123456";
[oracle@pridb wallet]$ mv ewallet.p12 ewallet.p12.1
主库再创建一个key:
alter system set encryption key identified by "oracle";
备库:
alter system set encryption wallet open identified by "oracle";
备库警告日志:
Thu Feb 25 21:09:22 2021
alter database recover managed standby database disconnect from session
Attempt to start background Managed Standby Recovery process (orcl)
Thu Feb 25 21:09:22 2021
MRP0 started with pid=19, OS id=32124
MRP0: Background Managed Standby Recovery process started (orcl)
started logmerger process
Thu Feb 25 21:09:27 2021
Managed Standby Recovery not using Real Time Apply
Parallel Media Recovery started with 2 slaves
Waiting for all non-current ORLs to be archived...
All non-current ORLs have been archived.
Media Recovery Log /oracle/arch/1_7_1065471869.dbf
Media Recovery Waiting for thread 1 sequence 8 (in transit)
Completed: alter database recover managed standby database disconnect from session
MRP0: Background Media Recovery terminated with error 28374
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
Recovery interrupted!
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
ORA-28374: typed master key not found in wallet
Some recovered datafiles maybe left media fuzzy
Media recovery may continue but open resetlogs may fail
Thu Feb 25 21:09:32 2021
MRP0: Background Media Recovery process shutdown (orcl)
重建后即使将主库重建的key传输仍无法正常进行日志应用
只能重建:
MOS:2512024.1