oracle TDE-snowhill
1 创建目录存放walletmkdir /u01/app/oracle/oradata/prod1/wallet
mkstore -wrl /u01/app/oracle/oradata/prod1/wallet -create
查看密钥文件：
$orapki wallet display -wallet /home/oracle/wallet_1
Oracle PKI Tool : Version 11.2.0.4.0 - Production
Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
Requested Certificates:
User Certificates:
Oracle Secret Store entries:
ORACLE.SECURITY.DB.ENCRYPTION.ASunfEaZK08pv56YLOa1IQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ORACLE.SECURITY.DB.ENCRYPTION.AXZMwdAGwk/5v+JFdo45QtsAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ORACLE.SECURITY.DB.ENCRYPTION.MASTERKEY
Trusted Certificates:
Subject: OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject: OU=Secure Server Certification Authority,O=RSA Data Security\, Inc.,C=US
Subject: CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
修改密码：orapki wallet change_pwd -wallet wallet_location[-oldpwd password ] [-newpwd password]
2更改
vi $ORACLE_HOME/network/admin/sqlnet.ora
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/u01/app/oracle/oradata/prod1/wallet)))
CREATE TABLESPACE sf_data
DATAFILE '/u01/app/oracle/oradata/PROD3/sf_data.dbf'
SIZE 10M autoextend on
ENCRYPTION USING '3DES168'
DEFAULT STORAGE(ENCRYPT);
3 创建master key文件，指定wallet密码，使用SYS用户登入系统，建立加密文件
alter system set encryption key> 4 启动wallet
SQL>>
关闭：
SQL>ALTER SYSTEM SET ENCRYPTION WALLET CLOSE>
关闭后再查询相关的表的会报错：
SQL> select * from scott.T;
ERROR at line 1:
ORA-28365: wallet is not open
5检查配置
SQL> select * from v$encryption_wallet;
WRL_TYPE WRL_PARAMETER STATUS
-------------------- -------------------------------------------------- ------------------
file /u01/app/oracle/oradata/prod1/wallet OPEN
SQL> select TABLESPACE_NAME,encrypted from dba_tablespaces where encrypted='YES';
TABLESPACE_NAME ENC
------------------------------ ---
SF_DATA YES
6
SQL> create table T(name varchar(32),sex varchar(2),age number(2,0)) tablespace sf_data;
SQL> insert into T values('snow','M',25);
7 相关说明
启用了TDE，exp对加密的内容是不可用的，如果导出会报：
About to export specified tables via Conventional Path ...
EXP-00111: Table T resides in an Encrypted Tablespace SF_DATA and will not be exported
Export terminated successfully with warnings.
7.1源库上执行导出操作时encryption wallet只有处于open状态才能导出完整的内容，如果是close的情况下一般会把表结构导出（但encryption= ENCRYPTED_COLUMNS_ONLY和encryption_mode=transparent两种情况除外，这两种情况连表结构都不会导出，直接报错退出）
7.2、目标库执行导入操作时，需要先对dumpfile文件进行解密(如果expdp出来的时候进行了加密)，再用自己的masterkey重新对表进行加密，这两个步骤中任意一个有问题都会引起导入失败
7.3、如果安全上允许建议启用auto login encryption wallet，数据库重启后会自动open,默认是不自动打开wallet的（有.sso文件）
orapki wallet create -wallet /u01/app/oracle/oradata/prod1/wallet -auto_login
页:
[1]