备案控制台
开发者社区 数据库 文章 正文

Oracle 11g加密备份

2021-08-24 742
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： Oracle的加密方式有三种：透明加密、密码加密、双模式加密。

默认情况下，Oracle会关闭加密功能：
RMAN> show all;
CONFIGURE ENCRYPTION FOR DATABASE OFF; # default
CONFIGURE ENCRYPTION ALGORITHM 'AES128'; # default
sys@OCP> SELECT ALGORITHM_ID,ALGORITHM_NAME FROM V$RMAN_ENCRYPTION_ALGORITHMS;
ALGORITHM_ID ALGORITHM_NAME

       1 AES128
       2 AES192
       3 AES256

1、透明加密(恢复表空间tp1)
如果要配置透明加密，那在RMAN下用CONFIGURE命令，透明加密也叫钱包加密，它是RMAN的默认加密方法。
这种方法不需要设置密码，很适合在本地的备份与恢复，如果备份不需要传到其他的机器上，建议采用这样的加密方法。
因为不需要密码，只需要配置加密/解密信任书，也就是Oracle Encryption Wallet

（1）设置透明加密，确保wallet是open的
RMAN> CONFIGURE ENCRYPTION FOR DATABASE ON;

new RMAN configuration parameters:
CONFIGURE ENCRYPTION FOR DATABASE ON;
new RMAN configuration parameters are successfully stored

RMAN> set encryption on;
executing command: SET encryption

（2)执行备份，报错。（注意：必须打开数据库钱包）

RMAN> backup as compressed backupset tablespace tp1;
Starting backup at 17-FEB-14
using channel ORA_DISK_1
channel ORA_DISK_1: starting compressed full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00006 name=/u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: starting piece 1 at 17-FEB-14
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03009: failure of backup command on ORA_DISK_1 channel at 02/17/2014 12:28:11
ORA-19914: unable to encrypt backup
ORA-28365: wallet is not open

（3）创建一个新目录，并指定为Wallet目录/u01/app/oracle/admin/ocp/wallet

[oracle@mydb ocp]$ mkdir -p /u01/app/oracle/admin/ocp/wallet

配置sqlnet.ora(可以不设置)
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/u01/app/oracle/admin/ocp/wallet)
))

（4）进入SQLPLUS程序，打开钱包，创建wallet,包括设置密码、生成信任文件、并启动wallet。
先查视图V$ENCRYPTION_WALLET看钱包有没有打开
sys@OCP> col WRL_PARAMETER for a50
sys@OCP> SELECT * FROM V$ENCRYPTION_WALLET;
WRL_TYPE WRL_PARAMETER STATUS

file /u01/app/oracle/admin/ocp/wallet CLOSED

idle> alter system set wallet open identified by "guoyJoe";
System altered.

（5）简单测试
RMAN> backup as compressed backupset tablespace tp1;
Starting backup at 17-FEB-14
using channel ORA_DISK_1
channel ORA_DISK_1: starting compressed full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00006 name=/u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: starting piece 1 at 17-FEB-14
channel ORA_DISK_1: finished piece 1 at 17-FEB-14
piece handle=/u01/app/oracle/product/11.2.0/dbs/48p0rotn_1_1 tag=TAG20140217T134423 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:15
Finished backup at 17-FEB-14
Starting Control File and SPFILE Autobackup at 17-FEB-14
piece handle=/backup/c-2735927810-20140217-02 comment=NONE
Finished Control File and SPFILE Autobackup at 17-FEB-14
RMAN> shutdown immediate;
database closed
database dismounted
Oracle instance shut down
RMAN> startup mount;
connected to target database (not started)
Oracle instance started
database mounted
Total System Global Area 1006809088 bytes
Fixed Size 2233520 bytes
Variable Size 478153552 bytes
Database Buffers 419430400 bytes
Redo Buffers 106991616 bytes

RMAN> restore tablespace tp1;
Starting restore at 17-FEB-14
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=18 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00006 to /u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: reading from backup piece /u01/app/oracle/product/11.2.0/dbs/48p0rotn_1_1
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 02/17/2014 13:45:32
ORA-19870: error while restoring backup piece /u01/app/oracle/product/11.2.0/dbs/48p0rotn_1_1
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open

RMAN> sql 'alter system set wallet open identified by "guoyJoe"';
sql statement: alter system set wallet open identified by "guoyJoe"

RMAN> restore tablespace tp1;
Starting restore at 17-FEB-14
using channel ORA_DISK_1

channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00006 to /u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: reading from backup piece /u01/app/oracle/product/11.2.0/dbs/48p0rotn_1_1
channel ORA_DISK_1: piece handle=/u01/app/oracle/product/11.2.0/dbs/48p0rotn_1_1 tag=TAG20140217T134423
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:25
Finished restore at 17-FEB-14

RMAN> recover tablespace tp1;
Starting recover at 17-FEB-14
using channel ORA_DISK_1

starting media recovery
media recovery complete, elapsed time: 00:00:00

Finished recover at 17-FEB-14
RMAN> alter database open;
database opened

2、密码加密(恢复表空间tp1)
为特定备份启用密码加密，使用SET ENCRYPTION命令，如下所示：

gyj@OCP> SELECT * FROM V$ENCRYPTION_WALLET;

WRL_TYPE WRL_PARAMETER STATUS

file /u01/app/oracle/admin/ocp/wallet CLOSED

RMAN> CONFIGURE ENCRYPTION FOR DATABASE off;
RMAN> show all;
CONFIGURE ENCRYPTION FOR DATABASE OFF;
CONFIGURE ENCRYPTION ALGORITHM 'AES128'; # default

RMAN> shutdown immediate;
database closed
database dismounted
Oracle instance shut down

RMAN> startup mount;
connected to target database (not started)
Oracle instance started
database mounted

Total System Global Area 1006809088 bytes
Fixed Size 2233520 bytes
Variable Size 478153552 bytes
Database Buffers 419430400 bytes
Redo Buffers 106991616 bytes

RMAN> set encryption on identified by "guoyJoe123" only;
executing command: SET encryption
RMAN> backup as compressed backupset tablespace tp1;

Starting backup at 17-FEB-14
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=18 device type=DISK
channel ORA_DISK_1: starting compressed full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00006 name=/u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: starting piece 1 at 17-FEB-14
channel ORA_DISK_1: finished piece 1 at 17-FEB-14
piece handle=/u01/app/oracle/product/11.2.0/dbs/4qp0sa4k_1_1 tag=TAG20140217T183811 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:15
Finished backup at 17-FEB-14
Starting Control File and SPFILE Autobackup at 17-FEB-14
piece handle=/backup/c-2735927810-20140217-0a comment=NONE
Finished Control File and SPFILE Autobackup at 17-FEB-14

RMAN> alter database open;
database opened

RMAN> shutdown immediate;
database closed
database dismounted
Oracle instance shut down

---册除表空间tp1中的数据文件
[oracle@mydb ocm]$ rm -rf tp1.dbf
RMAN> startup mount;

connected to target database (not started)
Oracle instance started
database mounted
Total System Global Area 1006809088 bytes

Fixed Size 2233520 bytes
Variable Size 478153552 bytes
Database Buffers 419430400 bytes
Redo Buffers 106991616 bytes

RMAN> restore tablespace tp1;
Starting restore at 17-FEB-14
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=18 device type=DISK

channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00006 to /u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: reading from backup piece /u01/app/oracle/product/11.2.0/dbs/4qp0sa4k_1_1
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 02/17/2014 18:39:50
ORA-19870: error while restoring backup piece /u01/app/oracle/product/11.2.0/dbs/4qp0sa4k_1_1
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open

RMAN> set decryption identified by "guoyJoe123";
executing command: SET decryption
using target database control file instead of recovery catalog

RMAN> restore tablespace tp1;

Starting restore at 17-FEB-14
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=1 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00006 to /u01/app/oracle/oradata/ocm/tp1.dbf
channel ORA_DISK_1: reading from backup piece /u01/app/oracle/product/11.2.0/dbs/4qp0sa4k_1_1
channel ORA_DISK_1: piece handle=/u01/app/oracle/product/11.2.0/dbs/4qp0sa4k_1_1 tag=TAG20140217T183811
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:25
Finished restore at 17-FEB-14
RMAN> recover tablespace tp1;
Starting recover at 17-FEB-14
using channel ORA_DISK_1
starting media recovery
media recovery complete, elapsed time: 00:00:00
Finished recover at 17-FEB-14

RMAN> alter database open;
database opened

3、双模式加密
可以同时使用透明加密和密码加密。如果使用备份在同一个数据库中执行还原和恢复，而且有时使用备份恢复另一个数据库，
这是一种有用的做法。如果两种方法都有效，可以使用密码或数据库钱包来还原备份。恢复到远程数据库时，必须在恢复前指定密码，
如下所示：
RMAN> set encryption on;
executing command: SET encryption
RMAN> set encryption identified by "guoyJoe12345";
executing command: SET encryption
RMAN>
如果仅为备份使用基于密码的加密，请为SET ENCRYPTION添加ONLY子句：

RMAN> set encryption identified by "guoyJoe12345" only;
executing command: SET encryption

结果，即使ENCRYPTION的默认设置为ON(因此会使用钱包加密方法)，
所有后续备份也仅使用密码加密，这种情况一直持续到关闭密码或完全退出RMAN时为止。

双模式加密是前面2种方式的混合模式,就不再继续测试了。

文章标签：
密钥管理服务
数据库备份
SQL
关系型数据库
数据安全/隐私保护
Oracle
数据库
关键词：
Oracle数据库一键上云备份
Oracle数据库一键上云11g
密钥管理服务oracle
密钥管理服务备份
Oracle数据库一键上云加密
郭一军_guoyJoe
目录
相关文章
坚持学习永不言弃
|
5月前
|
Oracle 关系型数据库 数据库
使用docker安装配置oracle 11g
使用docker安装配置oracle 11g
坚持学习永不言弃
172 0
非著名运维
|
7月前
|
Oracle 关系型数据库 数据库
Oracle 11G常见性能诊断报告(AWR/ADDM/ASH)收集
Oracle 11G常见性能诊断报告(AWR/ADDM/ASH)收集
非著名运维
98 0
度假的小鱼
|
7月前
|
Oracle 关系型数据库 数据库
9-2 Oracle数据库（表）的逻辑备份与恢复 --导出与导入
9-2 Oracle数据库（表）的逻辑备份与恢复 --导出与导入
度假的小鱼
91 1
机器学习Zero
|
2月前
|
存储 Oracle 关系型数据库
手把手教你安装Oracle——以oracle 11g为例
手把手教你安装Oracle——以oracle 11g为例
机器学习Zero
42 0
手把手教你安装Oracle——以oracle 11g为例
疯狂的猿
|
4月前
|
SQL 存储 Oracle
oracle如何定期备份数据库sql文件
【1月更文挑战第7天】oracle如何定期备份数据库sql文件
疯狂的猿
58 8
ap1253j8y
|
5月前
|
SQL Oracle 关系型数据库
docker 方式安装ORACLE 11g
docker 方式安装ORACLE 11g
ap1253j8y
218 4
vohelon
|
6月前
|
Oracle 关系型数据库 数据库
在Flink CDC中，使用Oracle 11g数据库的NUMBER类型作为主键
在Flink CDC中，使用Oracle 11g数据库的NUMBER类型作为主键
vohelon
57 1
讓丄帝愛伱
|
6月前
|
SQL Oracle 安全
window下Oracle 11G安装文档
window下Oracle 11G安装文档
讓丄帝愛伱
38 0
小小鱼儿小小林
|
8月前
|
Oracle 关系型数据库
Oracle 11g和12c的主要区别
Oracle 11g和12c的主要区别
小小鱼儿小小林
55 0
前方一片光明
|
9月前
|
Oracle 关系型数据库 数据库
通过数据泵expdp、impdp方式备份与还原（导出与导入）Oracle数据库
通过数据泵expdp、impdp方式备份与还原（导出与导入）Oracle数据库
前方一片光明
371 0

热门文章

最新文章

  • 1
    安全多方计算之三：同态加密
  • 2
    密码学系列之九：密钥管理
  • 3
    Java代码能实现这些隐藏的加密功能
  • 4
    查询oracle中所有用户信息
  • 5
    Oracle学习笔记_05_ 一个创建表空间、创建用户、授权的完整过程
  • 6
    ORACLE 配置event参数
  • 7
    Oracle RAC 归档 与 非归档 切换
  • 8
    oracle的字符集检查工具CSSCAN(二)
  • 9
    在redhat6.4下安装 Oracle® Database 11g Release 2
  • 10
    【Python Oracle】使用cx_Oracle 进行数据库操作介绍
  • 1
    Java代码能实现这些隐藏的加密功能
    62
  • 2
    安全多方计算之三：同态加密
    443
  • 3
    密码学系列之九：密钥管理
    278
  • 4
    Python的hashlib模块：7种加密算法深入剖析
    165
  • 5
    https跳过SSL认证时是不是就是不加密的,相当于http?
    128
  • 6
    通过一篇文章带你解决如何加密代码任然可以运行
    160
  • 7
    Linux vsFTPd服务详解——文件加密传输配置
    151
  • 8
    数据安全之道：加密算法在现代网络通信中的应用
    186
  • 9
    SpringBoot+随机盐值+双重MD5实现加密登录
    251
  • 10
    使用阿里云KMS产品针对 Springboot 接口参数加密解密功能
    168

    • 相关电子书

    更多
  • ADAM产品助力企业业务快速云化数据库和应用迁移（ADAM)
  • ORACLE数据库和应用异构 迁移最佳实践
  • 量子加密通信技术

    • 相关实验场景

    更多
  • 通过HTTPS加速网关快速部署网站加密
  • RSA非对称加密算法

    • 推荐镜像

    更多
  • oracle
  • debian-archive
  • mysql
    • 下一篇
    部署LAMP环境（Alibaba Cloud Linux 3）