Oracle GoldenGate 数据加密

GoldenGate 数据加密包括
 
Data encryption
缺省无数据加密
使用CounterPane的Blowfish对称加密算法,Collector在保存数据到队列之前自动执行解压缩
 
可以使用密钥对于参数文件中的密码进行加密
可以使用缺省密钥加密
可以使用自定义密钥加密
 
ggsci中提供了密码加密的命令 ENCRYPT PASSWORD
可以使用缺省密钥或者自定义密钥.
如果使用自定义密钥，则它必须存在于ENCKEYS文件中.

使用缺省密钥

GGSCI (testdb) 2> ENCRYPT PASSWORD ggadmin
No KEY specified, USING DEFAULT KEY...

Encrypted password:  AACAAAAAAAAAAAHAKCUIXDBIVBKDBCGJ

测试使用密钥登陆

GGSCI (testdb) 3> dblogin userid ggadmin, password AACAAAAAAAAAAAHAKCUIXDBIVBKDBCGJ, encryptkey DEFAULT
Successfully logged INTO DATABASE.

GGSCI (testdb) 4>

当然你也可以使用明文密码登陆

GGSCI (testdb) 3> dblogin userid ggadmin, password ggadmin
Successfully logged INTO DATABASE.

GGSCI (testdb) 4>

在参数文件中配置密钥

GGSCI (testdb) 6> VIEW params eorajj

EXTRACT EORAJJ
USERID GGADMIN, PASSWORD AACAAAAAAAAAAAHAKCUIXDBIVBKDBCGJ, encryptkey DEFAULT
RMTHOST 192.168.106.161, MGRPORT 7809 
RMTTRAIL /u01/app/oracle/goldengate/dirdat/jj 
TABLE GGUSER.T_RSYNC;


GGSCI (testdb) 7>

指定密钥加密

使用keygen生成key

-bash-3.2$ pwd
/u01/app/oracle/goldengate
-bash-3.2$ keygen 128 4
0x3F75005FC121AC2D80A9E913B2A2A54A

0x19F3CC3EA14A8A726B26356DE9FDDD0A

0xF370991E8273683757A380461F59164B

0xCCEE657E629C467C4320CC1F56B44E0B

-bash-3.2$

保存密钥,创建ENCKEYS文件,key name可以随便指定

-bash-3.2$ cat ENCKEYS 
securekey1 0x3F75005FC121AC2D80A9E913B2A2A54A
securekey2 0x19F3CC3EA14A8A726B26356DE9FDDD0A
securekey3 0xF370991E8273683757A380461F59164B
securekey4 0xCCEE657E629C467C4320CC1F56B44E0B
-bash-3.2$ pwd
/u01/app/oracle/goldengate
-bash-3.2$

将ENCKEYS文件传递到目标端

-bash-3.2$ scp ENCKEYS oracle@192.168.106.161:/u01/app/oracle/goldengate/
The authenticity OF host '192.168.106.161 (192.168.106.161)' can't be established.
RSA key fingerprint is 49:6e:da:ca:df:96:69:a4:e7:b1:2f:5a:a1:e8:18:0f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.106.161' (RSA) to the list of known hosts.
oracle@192.168.106.161's password: 
ENCKEYS              100% |******************************************************************************************************************************|   184       00:00    
-bash-3.2$

加密数据库密码

GGSCI (testdb) 2> encrypt password ggadmin encryptkey securekey1
Encrypted password:  AACAAAAAAAAAAAHAFDKJDFNHVATFGGTB


GGSCI (testdb) 3>

GGSCI (testdb) 3> dblogin userid ggadmin, password AACAAAAAAAAAAAHAFDKJDFNHVATFGGTB encryptkey securekey1
Successfully logged INTO DATABASE.

源端参数文件配置

GGSCI (testdb) 5> VIEW params eorajj

EXTRACT EORAJJ
USERID GGADMIN, PASSWORD AACAAAAAAAAAAAHAFDKJDFNHVATFGGTB, encryptkey securekey1
RMTHOST 192.168.106.161, MGRPORT 7809 
RMTTRAIL /u01/app/oracle/goldengate/dirdat/jj 
TABLE GGUSER.T_RSYNC;


GGSCI (testdb) 6>

目标端参数文件配置

GGSCI (joy.localdomain) 15> dblogin userid ggadmin, password AACAAAAAAAAAAAHAFDKJDFNHVATFGGTB, encryptkey securekey1
Successfully logged INTO DATABASE.

GGSCI (joy.localdomain) 16> VIEW params rorajj

REPLICAT RORAJJ
USERID GGADMIN, PASSWORD AACAAAAAAAAAAAHAFDKJDFNHVATFGGTB, encryptkey securekey1
HANDLECOLLISIONS
ASSUMETARGETDEFS
DISCARDFILE /u01/app/oracle/goldengate/dirrpt/RORAJJ.DSC, PURGE
MAP GGUSER.T_RSYNC, TARGET GGTARGET.T_ISRSYNC;


GGSCI (joy.localdomain) 17>