Using RMAN Transparent-mode Encrypted Backups -Manual

Scenario: 

Taking encrypted backup of tablespace using RMAN utility

• Connect to target database

[oracle@srv1 admin]$ rman target /

Recovery Manager: Release 12.1.0.2.0 - Production on Thu Aug 1 16:22:24 2019

Copyright (c) 1982, 2014, Oracle and/or its affiliates.  All rights reserved.

connected to target database: SMR1 (DBID=3409868754)

• Display and check encryption algorithm

RMAN> show encryption algorithm;

using target database control file instead of recovery catalog
RMAN configuration parameters for database with db_unique_name SMR1 are:
CONFIGURE ENCRYPTION ALGORITHM 'AES128'; # default

• Enable encryption

RMAN> set encryption on;

executing command: SET encryption

• Check Schema status

RMAN> report schema;

Report of database schema for database with db_unique_name SMR1

List of Permanent Datafiles
===========================
File Size(MB) Tablespace           RB segs Datafile Name
---- -------- -------------------- ------- ------------------------
1    790      SYSTEM               YES     /u01/app/oracle/oradata/smr1/system01.dbf
3    690      SYSAUX               NO      /u01/app/oracle/oradata/smr1/sysaux01.dbf
4    135      UNDOTBS1             YES     /u01/app/oracle/oradata/smr1/undotbs01.dbf
6    5        USERS                NO      /u01/app/oracle/oradata/smr1/users01.dbf

List of Temporary Files
=======================
File Size(MB) Tablespace           Maxsize(MB) Tempfile Name
---- -------- -------------------- ----------- --------------------
1    197      TEMP                 32767       /u01/app/oracle/oradata/smr1/temp01.dbf

• Backup tablespace users with TAG 'ENCRYPTED_USERS

RMAN> BACKUP TABLESPACE USERS TAG 'ENCRYPTED_USERS';

Starting backup at 01-AUG-19
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=69 device type=DISK
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00006 name=/u01/app/oracle/oradata/smr1/users01.dbf
channel ORA_DISK_1: starting piece 1 at 01-AUG-19
channel ORA_DISK_1: finished piece 1 at 01-AUG-19
piece handle=/u01/app/oracle/fast_recovery_area/SMR1/backupset/2019_08_01/o1_mf_nnndf_ENCRYPTED_USERS_gn5k5m0l_.bkp tag=ENCRYPTED_USERS comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:02
Finished backup at 01-AUG-19

• check backup status 

RMAN> list backupset TAG 'ENCRYPTED_USERS';


List of Backup Sets
===================


BS Key  Type LV Size       Device Type Elapsed Time Completion Time
------- ---- -- ---------- ----------- ------------ ---------------
1       Full    1.61M      DISK        00:00:01     01-AUG-19
        BP Key: 1   Status: AVAILABLE  Compressed: NO  Tag: ENCRYPTED_USERS
        Piece Name: /u01/app/oracle/fast_recovery_area/SMR1/backupset/2019_08_01/o1_mf_nnndf_ENCRYPTED_USERS_gn5k5m0l_.bkp
  List of Datafiles in backup set 1
  File LV Type Ckp SCN    Ckp Time  Name
  ---- -- ---- ---------- --------- ----
  6       Full 2006836    01-AUG-19 /u01/app/oracle/oradata/smr1/users01.dbf

• Using query check  encrypted backupset status 

RMAN> SELECT S.RECID AS "BS_REC", P.RECID AS "BP_REC", P.ENCRYPTED FROM   V$BACKUP_PIECE P, V$BACKUP_SET S WHERE  P.SET_STAMP = S.SET_STAMP   AND  P.SET_COUNT = S.SET_COUNT   AND  P.TAG ='ENCRYPTED_USERS';

    BS_REC     BP_REC ENC
---------- ---------- ---
         1          1 YES

RMAN>

[oracle@srv1 admin]$ ls -al /u01/app/oracle/product/12.1.0/dbhome_1/dbs/keystore
total 16
drwxr-xr-x  2 oracle oinstall 4096 Aug  1 16:19 .
drwxr-xr-x. 3 oracle oinstall 4096 Aug  1 16:23 ..
-rw-r--r--  1 oracle oinstall 2408 Aug  1 16:19 ewallet_2019080110494479_for_rman.p12
-rw-r--r--  1 oracle oinstall 3848 Aug  1 16:19 ewallet.p12
[oracle@srv1 admin]$