Oracle 12c 新特性 --- 数据泵安全性,命令行不显示加密密码

概述

This new option adds a parameter, ENCRYPTION_PWD_PROMPT = [Y | N], to the expdp and impdp command line that allows the user to indicate whether the Oracle Data Pump client should prompt for passwords or whether it should retrieve the value from the command line.

This improves security by reducing the possibility of a password being exposed to operating system commands, and by making it unnecessary to include database passwords in operating system scripts.

这个新选项向expdp和impdp命令行添加了一个参数，ENCRYPTION_PWD_PROMPT =[Y | N]，该命令行允许用户指示Oracle数据泵客户端是否应该提示密码，或者是否应该从命令行检索值。

通过降低操作系统命令的密码的可能性，以及在操作系统脚本中不需要包含数据库密码，这样可以提高安全性

Syntax and Description

 

ENCRYPTION_PWD_PROMPT=[YES | NO]
Specify ENCRYPTION_PWD_PROMPT=YES on the command line to instruct Data Pump to prompt you for the encryption password, rather than you entering it on the command line with the ENCRYPTION_PASSWORD parameter. The advantage to doing this is that the encryption password is not echoed to the screen when it is entered at the prompt. Whereas, when it is entered on the command line using the ENCRYPTION_PASSWORD parameter, it appears in plain text.

The encryption password that you enter at the prompt is subject to the same criteria described for the ENCRYPTION_PASSWORD parameter.

If you specify an encryption password on the export operation, you must also supply it on the import operation.

Restrictions

Concurrent use of the ENCRYPTION_PWD_PROMPT and ENCRYPTION_PASSWORD parameters is prohibited.

实验

1）数据泵加密导出用户数据，客户端不显示加密密码
[oracle@host1 ~]$ expdp test@pdbcndba DIRECTORY=dpump_dir1 DUMPFILE=expdat1.dmp logfile=expdat1.log SCHEMAS=test encryption_pwd_prompt=yes 

Export: Release 12.1.0.2.0 - Production on Sat Aug 5 14:23:36 2017

Copyright (c) 1982, 2014, Oracle and/or its affiliates.  All rights reserved.
Password: 

Connected to: Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options
 Encryption Password: 
Starting "TEST"."SYS_EXPORT_SCHEMA_01":  test/********@pdbcndba DIRECTORY=dpump_dir1 DUMPFILE=expdat1.dmp logfile=expdat1.log SCHEMAS=test encryption_pwd_prompt=yes 
Estimate in progress using BLOCKS method...
Processing object type SCHEMA_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 77 MB
Processing object type SCHEMA_EXPORT/USER
Processing object type SCHEMA_EXPORT/SYSTEM_GRANT
Processing object type SCHEMA_EXPORT/ROLE_GRANT
Processing object type SCHEMA_EXPORT/DEFAULT_ROLE
Processing object type SCHEMA_EXPORT/TABLESPACE_QUOTA
Processing object type SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
Processing object type SCHEMA_EXPORT/TABLE/TABLE
Processing object type SCHEMA_EXPORT/TABLE/COMMENT
Processing object type SCHEMA_EXPORT/TABLE/INDEX/INDEX
Processing object type SCHEMA_EXPORT/TABLE/CONSTRAINT/CONSTRAINT
Processing object type SCHEMA_EXPORT/TABLE/INDEX/STATISTICS/INDEX_STATISTICS
Processing object type SCHEMA_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type SCHEMA_EXPORT/STATISTICS/MARKER
. . exported "TEST"."LEO2"                               831.4 KB    6886 rows
. . exported "TEST"."VW_TEST"                            3.520 MB   90936 rows
Master table "TEST"."SYS_EXPORT_SCHEMA_01" successfully loaded/unloaded
******************************************************************************
Dump file set for TEST.SYS_EXPORT_SCHEMA_01 is:
  /backup/expdat1.dmp
Job "TEST"."SYS_EXPORT_SCHEMA_01" successfully completed at Sat Aug 5 14:24:11 2017 elapsed 0 00:00:30


impdp system@pdbcndba directory=dpump_dir1 dumpfile=expdat1.dmp logfile=impdp_emp2.log remap_schema=test:test5 encryption_pwd_prompt=yes

2）导入加密文件
[oracle@host1 ~]$ impdp system@pdbcndba directory=dpump_dir1 dumpfile=expdat1.dmp logfile=impdp_emp2.log remap_schema=test:test5 encryption_pwd_prompt=yes 
Import: Release 12.1.0.2.0 - Production on Sat Aug 5 14:26:12 2017

Copyright (c) 1982, 2014, Oracle and/or its affiliates.  All rights reserved.
Password: 

Connected to: Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options

Encryption Password: 
Master table "SYSTEM"."SYS_IMPORT_FULL_01" successfully loaded/unloaded
Starting "SYSTEM"."SYS_IMPORT_FULL_01":  system/********@pdbcndba directory=dpump_dir1 dumpfile=expdat1.dmp logfile=impdp_emp2.log remap_schema=test:test5 encryption_pwd_prompt=yes 
Processing object type SCHEMA_EXPORT/USER
Processing object type SCHEMA_EXPORT/SYSTEM_GRANT
Processing object type SCHEMA_EXPORT/ROLE_GRANT
Processing object type SCHEMA_EXPORT/DEFAULT_ROLE
Processing object type SCHEMA_EXPORT/TABLESPACE_QUOTA
Processing object type SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
Processing object type SCHEMA_EXPORT/TABLE/TABLE
Processing object type SCHEMA_EXPORT/TABLE/TABLE_DATA
. . imported "TEST5"."LEO2"                              831.4 KB    6886 rows
. . imported "TEST5"."VW_TEST"                           3.520 MB   90936 rows
Processing object type SCHEMA_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
Processing object type SCHEMA_EXPORT/STATISTICS/MARKER
Job "SYSTEM"."SYS_IMPORT_FULL_01" successfully completed at Sat Aug 5 14:26:30 2017 elapsed 0 00:00:15

参考链接：

http://docs.oracle.com/database/121/NEWFT/chapter12101.htm#NEWFT107

http://docs.oracle.com/database/121/SUTIL/GUID-A9C3C356-A6B4-45D0-9599-763F5B24E140.htm#SUTIL3933