RMAN -Auto-login Software Keystore -TDE

 RMAN -Auto-login Software Keystore -TDE

[oracle@srv1 admin]$ sqlplus / as sysdba

SQL*Plus: Release 12.1.0.2.0 Production on Thu Aug 1 16:38:26 2019

Copyright (c) 1982, 2014, Oracle.  All rights reserved.


Connected to:
Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production
With the Partitioning, OLAP, Advanced Analytics and Real Application Testing options

• Create auto-login keystore.

SQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE '/u01/app/oracle/product/12.1.0/dbhome_1/dbs/keystore' IDENTIFIED BY oracle;

keystore altered.

• Verify the created files (ewallet*.p12 and cwallet.sso). 

SQL> !ls -la /u01/app/oracle/product/12.1.0/dbhome_1/dbs/keystore
total 20
drwxr-xr-x  2 oracle oinstall 4096 Aug  1 16:40 .
drwxr-xr-x. 3 oracle oinstall 4096 Aug  1 16:28 ..
-rw-r--r--  1 oracle oinstall 3893 Aug  1 16:40 cwallet.sso
-rw-r--r--  1 oracle oinstall 2408 Aug  1 16:19 ewallet_2019080110494479_for_rman.p12
-rw-r--r--  1 oracle oinstall 3848 Aug  1 16:19 ewallet.p12

SQL>

• Restart the database

RMAN> SHUTDOWN IMMEDIATE;

using target database control file instead of recovery catalog

database closed

database dismounted

Oracle instance shut down

RMAN> STARTUP

connected to target database (not started)

Oracle instance started

database mounted

database opened

Total System Global Area    1795162112 bytes

Fixed Size                     2925456 bytes

Variable Size                553651312 bytes

Database Buffers            1224736768 bytes

Redo Buffers                  13848576 bytes

• Trying taking another encrypted backup for the users tablespace it will throw error

RMAN> SELECT KEY_ID FROM V$ENCRYPTION_KEYS;

KEY_ID

------------------------------------------------------------------------------

AW+nuISELk+Ov4+DaK8uq/EAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

RMAN>

RMAN> SET ENCRYPTION ON;

executing command: SET encryption

RMAN> BACKUP TABLESPACE users TAG 'ENCRYPTED_USERS';

Starting backup at 01-AUG-19

allocated channel: ORA_DISK_1

channel ORA_DISK_1: SID=62 device type=DISK

channel ORA_DISK_1: starting full datafile backup set

channel ORA_DISK_1: specifying datafile(s) in backup set

input datafile file number=00006 name=/u01/app/oracle/oradata/smr1/users01.dbf

channel ORA_DISK_1: starting piece 1 at 01-AUG-19

channel ORA_DISK_1: finished piece 1 at 01-AUG-19

piece handle=/u01/app/oracle/fast_recovery_area/SMR1/backupset/2019_08_01/o1_mf_nnndf_ENCRYPTED_USERS_gn5lhwsd_.bkp tag=ENCRYPTED_USERS comment=NONE

channel ORA_DISK_1: backup set complete, elapsed time: 00:00:01

Finished backup at 01-AUG-19

RMAN>

###############################################################################

• add the following to your sqlnet.ora file

ENCRYPTION_WALLET_LOCATION =
(SOURCE =
 (METHOD = FILE)  (METHOD_DATA =
 (DIRECTORY =/u01/app/oracle/product/12.1.0/dbhome_1/dbs/keystore))