oracle中wallet加密的几个测试笔记

oracle wallet使用与维护

从Oracle10gR2开始, 通过使用Oracle Wallet达到任意用户不使用密码登录数据库(非操作系统认证方式),这对于用脚本登录数据库进行操作来说是非常有用的；尤其对于企业安全要求很高，不希望用户名和密码明文存在配置文件中，而且对于密码的维护是极为方便的，比如我把wallet放在指定路径下，当修改密码时，只需统一覆盖wallet即可，对于有大量应用服务器尤为方便。

TDE中比较核心部分为wallet,对于这部分进行测试,对钱包加密有更加深刻的理解.

wallet随库启动本质
[oracle@localhost wallets]$ ls -ltr
total 8
-rw------- 1 oracle oinstall 3637 Jan  5 23:11 ewallet.p12
[oracle@localhost wallets]$
[oracle@localhost wallets]$
[oracle@localhost wallets]$ sqlplus / as sysdba
 
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:16:13 2016
 
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
 
 
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
 
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
 
 
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
 
Total System Global Area 5044088832 bytes
Fixed Size                  2261928 bytes
Variable Size            1040190552 bytes
Database Buffers         3992977408 bytes
Redo Buffers                8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
 
[oracle@localhost wallets]$ orapki wallet create -pwd xifenfei123 -wallet /home/u01/oracle/network/wallets  -auto_login
Oracle PKI Tool : Version 11.2.0.4.0 - Production
Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
 
[oracle@localhost wallets]$ ls -ltr
total 16
-rw------- 1 oracle oinstall 3637 Jan  5 23:11 ewallet.p12
-rw------- 1 oracle oinstall 3715 Jan  5 23:20 cwallet.sso
[oracle@localhost wallets]$ sqlplus / as sysdba
 
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:21:04 2016
 
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
 
 
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
 
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
 
 
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
 
Total System Global Area 5044088832 bytes
Fixed Size                  2261928 bytes
Variable Size            1040190552 bytes
Database Buffers         3992977408 bytes
Redo Buffers                8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
 
[oracle@localhost wallets]$ ls
cwallet.sso  ewallet.p12
[oracle@localhost wallets]$ rm cwallet.sso
[oracle@localhost wallets]$ sqlplus / as sysdba
 
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:30:55 2016
 
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
 
 
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
 
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
 
 
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
 
Total System Global Area 5044088832 bytes
Fixed Size                  2261928 bytes
Variable Size            1040190552 bytes
Database Buffers         3992977408 bytes
Redo Buffers                8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
 
SQL>  alter system set wallet open identified by "xifenfei123";
 
System altered.
 
SQL>  select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
通过测试我们发现当钱包中含cwallet.sso之时,wallet就会随库启动而open,当cwallet.sso被删除之后,wallet无法随库启动而open,由此可见,wallet是否随库启动而open取决于cwallet.sso文件.

修改wallet密码
[oracle@localhost wallets]$ orapki wallet change_pwd -wallet /home/u01/oracle/network/wallets
> -oldpwd xifenfei123 -newpwd www.111cn.net
Oracle PKI Tool : Version 11.2.0.4.0 - Production
Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
 
[oracle@localhost wallets]$ sqlplus / as sysdba
 
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:35:01 2016
 
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
 
 
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
 
SQL> alter system set wallet close identified by "xifenfei123";
 
System altered.
 
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
 
 
SQL> alter system set wallet open identified by "xifenfei123";
alter system set wallet open identified by "xifenfei123"
*
ERROR at line 1:
ORA-28353: failed to open wallet
 
 
SQL> alter system set wallet open identified by "www.111cn.net";
 
System altered.
 
SQL> select * from v$encryption_wallet;
 
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
 
 
SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
[oracle@localhost wallets]$ ls -ltr
total 8
-rw------- 1 oracle oinstall 3638 Jan  5 23:34 ewallet.p12
wallet文件丢失
[oracle@localhost wallets]$ mv ewallet.p12 ewallet.p12_bak
[oracle@localhost wallets]$ sqlplus / as sysdba
 
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:36:55 2016
 
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
 
 
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
 
SQL> alter system set wallet close identified by "www.111cn.net";
 
System altered.
 
SQL> alter system set wallet open identified by "www.111cn.net";
alter system set wallet open identified by "www.111cn.net"
*
ERROR at line 1:
ORA-28367: wallet does not exist
 
 
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.111cn.net";
ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.111cn.net"
*
ERROR at line 1:
ORA-28362: master key not found
 
 
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.xifenfei";
ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.xifenfei"
*
ERROR at line 1:
ORA-28353: failed to open wallet
如果wallet文件丢失,没有办法open钱包,也就是说加密数据无法读取.备份ewallet.p12文件非常重要

在客户端使用wallet无密码登录的步骤:

1.创建wallet(tnsname.ora里面的连接串，sqlnet.ora文件内容都要复制到客户端)
2.把wallet复制到客户端指定路径（注意文件权限和属主）
3.修改客户端的tnsname.ora文件里连接服务器的连接串为创建时的连接串，在sqlnet.ora文件里添加如下内容：

WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=e:\temp\wallet)))
SQLNET.WALLET_OVERRIDE = TRUE

4.在sqlplus无密码等里测试
  sqlplus /@skate_192.168.1.9

 

在jdbc里连接数据库密码形式如下：
   public static Connection getConnection() throws SQLException {
      DriverManager.registerDriver(new OracleDriver());
      Connection conn = DriverManager
              .getConnection("jdbc:oracle:oci:/@tnskate");
      conn.setAutoCommit(false);
      return conn;
   }

联系：手机(13429648788) QQ(107644445)QQ咨询惜分飞
标题：http://www.xifenfei.com/2016/01/关于wallet加密的几个测试.html

时间： 2024-08-03 16:20:37

oracle中wallet加密的几个测试笔记的相关文章

MySQL和Oracle中的唯一性索引从差别(r12笔记第83天)

   今天在修复MySQL数据的时候,发现一个看起来"奇怪"的问题.   有一个表里存在一个唯一性索引,这个索引包含3个列,这个唯一性索引的意义就是通过这3个列能够定位到具体1行的数据,但是在实际中却发现这个唯一性索引还是有一个地方可能被大家忽略了.  我们先来看看数据的情况.  CREATE TABLE `test_base_data` (   `servertime` datetime DEFAULT NULL COMMENT '时间',   `appkey` varchar(64

Oracle中的PGA监控报警分析(r11笔记第97天)

最近接到一个数据库报警,让我颇有些意外,这是一个PGA相关的报警.听起来感觉是应用端的资源调用出了问题. 报警内容大体如下: 报警内容: PGA Alarm on alltest ------------------------------------报警级别: PROBLEM ------------------------------------监控项目: PGA:6118.6 这是一个12cR1的环境,是一套测试环境,确切的说是多套环境整合后的一套大的测试环境,里面含有近8个PDB,也就是

MySQL中BOOL/BOOLEAN 与 TINYINT 区别 - 测试笔记

(一) 数据类型测试 (1). 布尔类型BOOL/BOOLEAN 与 微整型TINYINT a). 创建测试表结构 root@localhost : test 05:12:49> CREATE TABLE boolean_test(ID INT NOT NULL AUTO_INCREMENT, ->                           Online_Flag BOOL, ->                           Lock_Flag BOOLEAN, -&g

MySQL和Oracle中的半连接测试总结（一）

SQL中的半连接在MySQL和Oracle还是存在一些差距,从测试的情况来看,Oracle的处理要更加全面. 首先我们来看看在MySQL中怎么测试,对于MySQL方面的测试也参考了不少海翔兄的博客文章,自己也完整的按照他的测试思路练习了一遍. 首先创建下面的表: create table users( userid int(11) unsigned not null, user_name varchar(64) default null, primary key(userid) )engine=

oracle中rman备份集加密的方法

 下面我们来看看一个oracle中rman备份集加密的方法,希望这个例子能帮助到各位朋友了．   数据的安全越来越重要,不是说你的生产库安全,你的数据就一定安全了,rman备份也是泄露数据的一个重要地方,如果别人拿到了你的备份集,一样等同入侵了你的生产库.为了rman备份的安全,最简单方式就是使用set encryption方式在rman备份过程中设置密码,需要版本为10.2及其以后企业版版,另外如果需要备份到带库只能使用oracle自己的osb(Oracle Secure Backup),注意

Oracle中对列加密的方法

Oracle支持多种列加密方式: 1,透明数据加密(TDE):create table encrypt_col(id int,txt varchar2(100) encrypt using '算法名称' identified by '密钥' no salt);优点:对应用完全透明缺点:需要数据库管理员管理wallet,增加了管理复杂性,也无法避免数据库管理员查看原文. 2,使用DBMS_CRYPTO包优点:只要应用程序保存好密钥,数据库管理员无法察看: 测试:DECLARE   input_st

Oracle中的MD5加密详解_oracle

一.技术点  1. DBMS_OBFUSCATION_TOOLKIT.MD5 DBMS_OBFUSCATION_TOOLKIT.MD5是MD5编码的数据包函数,但偶在使用select DBMS_OBFUSCATION_TOOLKIT.MD5(input_string =>'abc') a from Dual时,却有错误提示,看来该函数只能直接在程序包中调用,不能直接应用于SELECT语句. 2.Utl_Raw.Cast_To_Raw DBMS_OBFUSCATION_TOOLKIT.MD5返回的

三种Oracle RMAN备份加密策略（下）

    说明:本篇参考eygle老师的作品<Oracle DBA手记4:数据安全警示录>,特此表示感谢. 3 .Oracle Wallet加密策略   Oracle Wallet是一种加密安全策略,过去我们在TDE(Oracle透明加密)部分研究过这个组件.简单的说,Oracle Wallet就是在本机上配置一个加密配置文件,通过SQL命令控制Oracle Wallet的开启关闭状态,如果Wallet关闭或者不存在,那么一些加密的信息(包括TDE和RMAN备份集合)数据就不能正常打开.   使

oracle中通过DBMS

 下面我们来看看oracle中通过DBMS_CRYPTO包对表敏感字段进行加密方法,有需要了解的朋友可一起来看看吧.   在安全越来越重视的近体,我们不少时候需要对数据库中的某个表的敏感列数据(银行卡,身份证号码,金额等)进行加密,方式数据泄密,在11.2.0.4中可以通过dbms_crypto包方式实现,增加oracle的加密效率,本文提供处理思路,其他可以根据需求尽情发挥 数据库版本 SQL> select * from v$version;   BANNER ---------------