配置pdb为 isolated mode keystore有两种方式,一种就是
administer key management isolate keystore,这个语句适合于本来这个pdb是处于united mode,并且这个pdb的master encryption key已经创建,并且也已经有数据是用这个master encryption key加密的情况下,由united mode转化为isolated mode
另外一种方式就是在初始创建这个pdb的时候,这个时候这个pdb还没有master encryption key,这个pdb的默认方式是united mode,但是还没有创建master encryption key,在这种情况下如果将这个pdb修改为isolated mode
18:22:07 SQL> create pluggable database tdetest2pdb10888 admin user pdbadmin identified by tdetest2;
Pluggable database created.
Elapsed: 00:00:04.11
18:22:37 SQL> alter pluggable database tdetest2pdb10888 open read write instances=all;
Pluggable database altered.
Elapsed: 00:00:09.04
18:23:04 SQL> alter session set container=tdetest2pdb10888;
Session altered.
Elapsed: 00:00:00.00
18:23:26 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
CLOSED UNITED
Elapsed: 00:00:00.01
18:23:41 SQL> administer key management set keystore open identified by "WelCome-123#";
keystore altered.
Elapsed: 00:00:00.11
18:24:13 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY UNITED
Elapsed: 00:00:00.01
pdb tdetest2pdb10888是新建的,显示为united mode,master encryption key还没有创建
这个时候,tde_configuration这个参数是为空的
18:24:32 SQL> show parameter tde_configuration;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
tde_configuration string
我们修改了这个参数后,keystore mode就会转变成isolated mode
18:24:32 SQL> show parameter tde_configuration;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
tde_configuration string
18:26:03 SQL> alter system set tde_configuration='keystore_configuration=file' scope=both;
System altered.
Elapsed: 00:00:00.03
18:26:44 SQL> show parameter tde_configuration;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
tde_configuration string keystore_configuration=file
18:26:52 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY ISOLATED
Elapsed: 00:00:00.00
如果我们重新将这个参数设置为空的话,则keystore mode又会变回united mode
18:27:05 SQL> alter system set tde_configuration='' scope=both;
System altered.
Elapsed: 00:00:00.03
18:28:01 SQL> show parameter tde_configuration;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
tde_configuration string
18:28:16 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY UNITED
Elapsed: 00:00:00.01
下面重新设置tde_configuration,然后开始测试isolated mode的pdb
18:28:30 SQL> alter system set tde_configuration='keystore_configuration=file' scope=both;
System altered.
Elapsed: 00:00:00.03
18:30:00 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN_NO_MASTER_KEY ISOLATED
Elapsed: 00:00:00.00
因为这个pdb是新建的,也没有创建master encryption key,所以其实keystore也还没有创建,因为现在是isolated mode,所以我们需要先创建keystore
18:31:48 SQL> administer key management create keystore identified by tdetest2pdb10888;
keystore altered.
Elapsed: 00:00:00.15
这个命令会在wallet_root下创建一个这个pdb的guid为目录名的目录,下面创建tde目录,然后tde目录下是这个password-protected 的keystore,名字为ewallet.p12
[oracle@scaqai06adm07 tde]$ pwd
/u01/app/v1/tdetest2/B74BAD732DE4D14EE053D529850A546A/tde
[oracle@scaqai06adm07 tde]$ ls -al
total 108
drwxr-x--- 2 oracle oinstall 20480 Dec 25 18:32 .
drwxr-x--- 3 oracle oinstall 20480 Dec 25 18:32 ..
-rw------- 1 oracle oinstall 2555 Dec 25 18:32 ewallet.p12
在修改tde_configuration参数后需要先将这个PDB重启一遍,否则直接创建master encryption key会碰到下面的错误
18:34:54 SQL> administer key management set key force keystore identified by tdetest2pdb10888 with backup;
administer key management set key force keystore identified by tdetest2pdb10888 with backup
*
ERROR at line 1:
ORA-46627: keystore password mismatch
Elapsed: 00:00:00.00
我们按照下面的步骤做一遍,先将pdb重启一遍,再创建master encryption key
19:05:09 SQL> alter pluggable database close immediate instances=all;
Pluggable database altered.
Elapsed: 00:00:01.46
19:05:35 SQL> alter pluggable database open read write instances=all;
Pluggable database altered.
Elapsed: 00:00:03.02
在先将pdb重启一遍之后,就不会再碰到这个问题了
下面我们测试一下pdb本来是united mode并且已经创建了master encrypted key的情况下如何转化为isolated mode
19:20:20 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN UNITED
Elapsed: 00:00:00.02
19:21:05 SQL> show con_name;
CON_NAME
------------------------------
TDETEST2PDB10892
这是一个新的pdb,并且已经创建了master encryption key,并且已经基于这个master encryption key创建了表 表空间等
一条命令就可以实现将keystore从united mode转化为isolated mode
这个命令应该是做了如下的操作,一个是将这个pdb的tde_configuration参数进行了修改,另外就是将这个pdb原来在那个united mode的keystore里面的key move到了新的united keystore里面
19:21:13 SQL> administer key management isolate keystore identified by tdetest2pdb10892 from root keystore force keystore identified by "WelCome-123#" with backup;
keystore altered.
Elapsed: 00:00:00.73
19:24:05 SQL> show parameter tde_configuration;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
tde_configuration string KEYSTORE_CONFIGURATION=FILE
19:24:12 SQL> select status,keystore_mode from v$encryption_wallet;
STATUS KEYSTORE
------------------------------ --------
OPEN ISOLATED
tde的password如果忘记了,那就没法弄了
vault的密码还可以搞几个vault账号,如果忘了这个,还有那个,可是tde的密码只有一个啊,那要是忘了可怎么办呢
sys的密码很重要,可以sys的密码忘了也没关系,你只要能登录操作系统就没问题