Oracle DataGuard环境下使用TDE透明加密需要注意的点

最新推荐文章于 2024-07-26 17:07:32 发布

DBhanG

最新推荐文章于 2024-07-26 17:07:32 发布

阅读量911

点赞数

文章标签： oracle 数据库

本文链接：https://blog.csdn.net/baoyuhang0/article/details/114556963

版权

ORACLE 专栏收录该内容

20 篇文章 2 订阅

订阅专栏

DataGuard环境下使用TDE透明加密:
开启TDE:
1.创建一个新目录，并指定为wallet目录

$ mkdir -p /oracle/wallet

并设置wallet目录，方法很简单，编辑参数文件sqlnet.ora即可：

$ vi $ORACLE_HOME/network/admin/sqlnet.ora
加入以下信息，保存。
ENCRYPTION_WALLET_LOCATION=
 (SOURCE=
   (METHOD=file)
   (METHOD_DATA=
      (DIRECTORY=/oracle/wallet)
   )
 )
ENCRYPTION_WALLET_LOCATION参数的作用就是告知Wallet的实现方式和物理位置。
上述示例中将/oracle/wallet目录作为Master Key的存放位置。

2.创建master key文件，指定wallet密码
使用SYS用户登陆，通过以下命令建立加密文件：

SQL> alter system set encryption key identified by "123456";

其中，123456为wallet密码。Oracle Wallet是一个可以打开关闭的功能组件，设置密码之后，只有通过密码口令可以启用wallet功能。
此时，在设置的目录下会多出一个ewallet.p12文件。这就是生成的master key文件。

3.启动和关闭Wallet
启动Wallet：

SQL> alter system set encryption wallet open identified by "123456";

关闭Wallet并查看：

SQL> alter system set encryption wallet close identified by "123456";

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

4.主库切换日志,观察备库警告日志:
内容:

Media Recovery Log /oracle/arch/1_11_1065273402.dbf
Apply redo for TSE master key re-key failed: wallet error 28365
Errors with log /oracle/arch/1_11_1065273402.dbf
MRP0: Background Media Recovery terminated with error 28365
Archived Log entry 12 added for thread 1 sequence 14 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_31775.trc:
ORA-28365: wallet is not open
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 15 dbid 1593054136 branch 1065273402
Recovery interrupted!
Recovered data files to a consistent state at change 967568
Tue Feb 23 14:00:33 2021
MRP0: Background Media Recovery process shutdown (orcl)

5.拷贝钱包相关文件至备库并在主备库查询钱包信息:
主库:

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

备库:

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  CLOSED

启动Wallet：

SQL> alter system set encryption wallet open identified by "123456";

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

备库开启MRP日志应用:

Media Recovery Waiting for thread 1 sequence 17 (in transit)
Tue Feb 23 14:06:48 2021
Archived Log entry 15 added for thread 1 sequence 17 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 18 dbid 1593054136 branch 1065273402
Tue Feb 23 14:06:52 2021
Media Recovery Log /oracle/arch/1_17_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 18 (in transit)
Tue Feb 23 14:08:16 2021
Archived Log entry 16 added for thread 1 sequence 18 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 19 dbid 1593054136 branch 1065273402
Tue Feb 23 14:08:18 2021
Media Recovery Log /oracle/arch/1_18_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 19 (in transit)

DG日志应用正常.

如果此时主库重建key,那么备库必须重建.

参考文档:
https://www.eygle.com/archives/2020/07/oracle_faq_tde_.html

Mos:
2512024.1

例如:
先同步DG,之后在主库创建钱包并拷贝至备库,在备库打开钱包,此时可以应用.

在主库重建一个钱包,

SQL> alter system set encryption key identified by "123456";

查询主备库主密钥:

mkstore -wrl /oracle/wallet -viewEntry ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
AUL9pyEcvE8lv3uKTzU0TxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

主库:

alter system set encryption wallet close identified by "123456";
[oracle@pridb wallet]$ mv ewallet.p12 ewallet.p12.1

主库再创建一个key:

alter system set encryption key identified by "oracle";

备库:

alter system set encryption wallet open identified by "oracle";

备库警告日志:

Thu Feb 25 21:09:22 2021
alter database recover managed standby database disconnect from session
Attempt to start background Managed Standby Recovery process (orcl)
Thu Feb 25 21:09:22 2021
MRP0 started with pid=19, OS id=32124 
MRP0: Background Managed Standby Recovery process started (orcl)
 started logmerger process
Thu Feb 25 21:09:27 2021
Managed Standby Recovery not using Real Time Apply
Parallel Media Recovery started with 2 slaves
Waiting for all non-current ORLs to be archived...
All non-current ORLs have been archived.
Media Recovery Log /oracle/arch/1_7_1065471869.dbf
Media Recovery Waiting for thread 1 sequence 8 (in transit)
Completed: alter database recover managed standby database disconnect from session
MRP0: Background Media Recovery terminated with error 28374
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
Recovery interrupted!
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
ORA-28374: typed master key not found in wallet
Some recovered datafiles maybe left media fuzzy
Media recovery may continue but open resetlogs may fail
Thu Feb 25 21:09:32 2021
MRP0: Background Media Recovery process shutdown (orcl)

重建后即使将主库重建的key传输仍无法正常进行日志应用
只能重建:
MOS:2512024.1