oracle tde技术,oracle TDE

1 创建目录存放wallet

mkdir /u01/app/oracle/oradata/prod1/wallet

mkstore -wrl /u01/app/oracle/oradata/prod1/wallet -create

查看密钥文件：

[oracle@iZm5eg3yspb12f3ke9ts08Z wallet_1]$ orapki wallet display -wallet /home/oracle/wallet_1

Oracle PKI Tool : Version 11.2.0.4.0 - Production

Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.

Requested Certificates:

User Certificates:

Oracle Secret Store entries:

ORACLE.SECURITY.DB.ENCRYPTION.ASunfEaZK08pv56YLOa1IQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.AXZMwdAGwk/5v+JFdo45QtsAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY

Trusted Certificates:

Subject: OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Subject: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Subject: OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Subject: OU=Secure Server Certification Authority,O=RSA Data Security\, Inc.,C=US

Subject: CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

修改密码：orapki wallet change_pwd -wallet wallet_location[-oldpwd password ] [-newpwd password]

2更改

vi $ORACLE_HOME/network/admin/sqlnet.ora

ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/u01/app/oracle/oradata/prod1/wallet)))

CREATE TABLESPACE sf_data

DATAFILE '/u01/app/oracle/oradata/PROD3/sf_data.dbf'

SIZE 10M autoextend on

ENCRYPTION USING '3DES168'

DEFAULT STORAGE(ENCRYPT);

3 创建master key文件，指定wallet密码，使用SYS用户登入系统，建立加密文件

alter system set encryption key identified by "oracle";

4 启动wallet

SQL> ALTER SYSTEM SET ENCRYPTION WALLET OPEN IDENTIFIED BY oracle;

关闭：

SQL>ALTER SYSTEM SET ENCRYPTION WALLET CLOSE identified by oracle;

关闭后再查询相关的表的会报错：

SQL> select * from scott.T;

ERROR at line 1:

ORA-28365: wallet is not open

5检查配置

SQL> select * from v$encryption_wallet;

WRL_TYPE WRL_PARAMETER STATUS

-------------------- -------------------------------------------------- ------------------

file /u01/app/oracle/oradata/prod1/wallet OPEN

SQL> select TABLESPACE_NAME,encrypted from dba_tablespaces where encrypted='YES';

TABLESPACE_NAME ENC

------------------------------ ---

SF_DATA YES

6

SQL> create table T(name varchar(32),sex varchar(2),age number(2,0)) tablespace sf_data;

SQL> insert into T values('snow','M',25);

7 相关说明

启用了TDE，exp对加密的内容是不可用的，如果导出会报：

About to export specified tables via Conventional Path ...

EXP-00111: Table T resides in an Encrypted Tablespace SF_DATA and will not be exported

Export terminated successfully with warnings.

7.1源库上执行导出操作时encryption wallet只有处于open状态才能导出完整的内容，如果是close的情况下一般会把表结构导出(但encryption= ENCRYPTED_COLUMNS_ONLY和encryption_mode=transparent两种情况除外，这两种情况连表结构都不会导出，直接报错退出)

7.2、目标库执行导入操作时，需要先对dumpfile文件进行解密(如果expdp出来的时候进行了加密)，再用自己的masterkey重新对表进行加密，这两个步骤中任意一个有问题都会引起导入失败

7.3、如果安全上允许建议启用auto login encryption wallet，数据库重启后会自动open,默认是不自动打开wallet的(有.sso文件)

orapki wallet create -wallet /u01/app/oracle/oradata/prod1/wallet -auto_login