Oracle DataGuard环境下使用TDE透明加密需要注意的点

DataGuard环境下使用TDE透明加密:
开启TDE:
1.创建一个新目录，并指定为wallet目录

$ mkdir -p /oracle/wallet

并设置wallet目录，方法很简单，编辑参数文件sqlnet.ora即可：

$ vi $ORACLE_HOME/network/admin/sqlnet.ora
加入以下信息，保存。
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=file)(METHOD_DATA=(DIRECTORY=/oracle/wallet)))
ENCRYPTION_WALLET_LOCATION参数的作用就是告知Wallet的实现方式和物理位置。
上述示例中将/oracle/wallet目录作为Master Key的存放位置。

2.创建master key文件，指定wallet密码
使用SYS用户登陆，通过以下命令建立加密文件：

SQL> alter system set encryption key identified by "123456";

其中，123456为wallet密码。Oracle Wallet是一个可以打开关闭的功能组件，设置密码之后，只有通过密码口令可以启用wallet功能。
此时，在设置的目录下会多出一个ewallet.p12文件。这就是生成的master key文件。

3.启动和关闭Wallet
启动Wallet：

SQL> alter system set encryption wallet open identified by "123456";

关闭Wallet并查看：

SQL> alter system set encryption wallet close identified by "123456";

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

4.主库切换日志,观察备库警告日志:
内容:

Media Recovery Log /oracle/arch/1_11_1065273402.dbf
Apply redo for TSE master key re-key failed: wallet error 28365
Errors with log /oracle/arch/1_11_1065273402.dbf
MRP0: Background Media Recovery terminated with error 28365
Archived Log entry 12 added for thread 1 sequence 14 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_31775.trc:
ORA-28365: wallet is not open
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 15 dbid 1593054136 branch 1065273402
Recovery interrupted!
Recovered data files to a consistent state at change 967568
Tue Feb 23 14:00:33 2021
MRP0: Background Media Recovery process shutdown (orcl)

5.拷贝钱包相关文件至备库并在主备库查询钱包信息:
主库:

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

备库:

select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  CLOSED

启动Wallet：

SQL> alter system set encryption wallet open identified by "123456";select * from v$encryption_wallet;
WRL_TYPE             WRL_PARAME      STATUS
-------------------- ----------    ------------------
file                 /oracle/wallet  OPEN

备库开启MRP日志应用:

Media Recovery Waiting for thread 1 sequence 17 (in transit)
Tue Feb 23 14:06:48 2021
Archived Log entry 15 added for thread 1 sequence 17 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 18 dbid 1593054136 branch 1065273402
Tue Feb 23 14:06:52 2021
Media Recovery Log /oracle/arch/1_17_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 18 (in transit)
Tue Feb 23 14:08:16 2021
Archived Log entry 16 added for thread 1 sequence 18 rlc 1065273402 ID 0x5ef3d9b8 dest 2:
RFS[6]: No standby redo logfiles created
RFS[6]: Opened log for thread 1 sequence 19 dbid 1593054136 branch 1065273402
Tue Feb 23 14:08:18 2021
Media Recovery Log /oracle/arch/1_18_1065273402.dbf
Media Recovery Waiting for thread 1 sequence 19 (in transit)

DG日志应用正常.

如果此时主库重建key,那么备库必须重建.

参考文档:
https://www.eygle.com/archives/2020/07/oracle_faq_tde_.html

Mos:
2512024.1

例如:
先同步DG,之后在主库创建钱包并拷贝至备库,在备库打开钱包,此时可以应用.

在主库重建一个钱包,

SQL> alter system set encryption key identified by "123456";

查询主备库主密钥:

mkstore -wrl /oracle/wallet -viewEntry ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
AUL9pyEcvE8lv3uKTzU0TxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

主库:

alter system set encryption wallet close identified by "123456";
[oracle@pridb wallet]$ mv ewallet.p12 ewallet.p12.1

主库再创建一个key:

alter system set encryption key identified by "oracle";

备库:

alter system set encryption wallet open identified by "oracle";

备库警告日志:

Thu Feb 25 21:09:22 2021
alter database recover managed standby database disconnect from session
Attempt to start background Managed Standby Recovery process (orcl)
Thu Feb 25 21:09:22 2021
MRP0 started with pid=19, OS id=32124
MRP0: Background Managed Standby Recovery process started (orcl)started logmerger process
Thu Feb 25 21:09:27 2021
Managed Standby Recovery not using Real Time Apply
Parallel Media Recovery started with 2 slaves
Waiting for all non-current ORLs to be archived...
All non-current ORLs have been archived.
Media Recovery Log /oracle/arch/1_7_1065471869.dbf
Media Recovery Waiting for thread 1 sequence 8 (in transit)
Completed: alter database recover managed standby database disconnect from session
MRP0: Background Media Recovery terminated with error 28374
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
Recovery interrupted!
Errors in file /oracle/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_pr00_32126.trc:
ORA-28374: typed master key not found in wallet
ORA-28374: typed master key not found in wallet
Some recovered datafiles maybe left media fuzzy
Media recovery may continue but open resetlogs may fail
Thu Feb 25 21:09:32 2021
MRP0: Background Media Recovery process shutdown (orcl)

重建后即使将主库重建的key传输仍无法正常进行日志应用
只能重建:
MOS:2512024.1

Oracle DataGuard环境下使用TDE透明加密需要注意的点相关推荐

oracle rac 主备轮训,RAC+DATAGUARD环境下主备切换
RAC+DATAGUARD环境下主备切换环境介绍该文档的操作步骤适用于Primary DB为RAC,Standby DB为single instance的环境,在执行操作前要确保主库的物理备份完 ...
Oracle RAC 环境下的连接管理（转） --- 防止原文连接失效
崔华老师的文章!!! 这篇文章详细介绍了Oracle RAC环境下的连接管理,分别介绍了什么是 Connect Time Load Balancing.Runtime Connection Load ...
Oracle RAC 环境下的连接管理
转自 http://www.oracle.com/technetwork/cn/articles/database-performance/oracle-rac-connection-mgmt-165 ...
oracle ebs 数据源,Oracle EBS环境下查找数据源(Form篇)
关于在Oracle EBS环境下如何查找数据源的文章几年前就已经开始整理,但是其中关于OAF方面的一直没有整理,导致这份文档一直残缺不全, 有很多次同事都向我索要相关文档都未能如愿以偿,新的一届培训工 ...
Oracle RAC环境下如何定位并杀掉最终阻塞的会话
‍ ‍ 导读:Oracle RAC环境下定位并杀掉最终阻塞的会话,本文通过一个测试demo来具体介绍. 实验环境: Oracle RAC 11.2.0.4 (2节点) 1.模拟故障:会话被级联阻塞 2 ...
鼎甲第14期 Back You Up 公开课:迪备在Oracle DataGuard环境中的使用
鼎甲第14期 Back You Up 公开课:迪备在Oracle DataGuard环境中的使用课程录像回看文章下方是我的微信,欢迎加我.
Oracle RAC环境下如何更新patch(Rolling Patch)
Oracle RAC数据库环境与单实例数据库环境有很多共性,也有很多异性.对于数据库补丁的更新同样如此,都可以通过opatch来完成.但RAC环境的补丁更新有几种不同的更新方式,甚至于可以在零停机的情 ...
oracle查询file_name,Oracle DG环境下db_file_name_convert的实际意义
关于DG环境下备库数据文件重命名的问题: **前言:** 主要想表明DG环境下备库数据文件重命名的问题,以及db_file_name_convert与log_file_name_convert的作用. ...
android登录加密传输,android环境下两种md5加密方式(示例代码)
在平时开发过程中,MD5加密是一个比較经常使用的算法,最常见的使用场景就是在帐号注冊时,用户输入的password经md5加密后,传输至server保存起来.尽管md5加密经经常使用.可是md5的加密 ...

Oracle DataGuard环境下使用TDE透明加密需要注意的点

Oracle DataGuard环境下使用TDE透明加密需要注意的点相关推荐

最新文章

热门文章