The Oracle RMAN backup encryption is necessary if you want to backup your database into the Oracle cloud. In Oracle 12c, you have three methods available to encrypt an Oracle RMAN backup:
- with a passphrase
- with a master encryption key
- hybrid with a passphrase and an encryption key
In this article, we will walk you through the steps to configure your database environment with a master encryption key and a keystore. I have been using the same procedure to Backup and Recovery into the Oracle cloud. And in the cloud, I don’t like to type in passwords manually for every action or write passwords in backup and restore scripts.
Configure SQLNET.ora in $TNS_ADMIN to use a Keystore
ENCRYPTION_WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = /u00/app/oracle/network/wallet)
)
)
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = /u00/app/oracle/network/wallet)
)
)
Create Keystore as SYSDBA
SQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE '/u00/app/oracle/network/wallet' IDENTIFIED BY "my#wallet16";
Open Keystore
SQL> ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "my#wallet16";The status is set to OPEN_NO_MASTER_KEY.
SQL> SELECT wrl_parameter, wallet_type, status
2 FROM v$encryption_wallet;
WRL_PARAMETER WALLET_TYPE STATUS
----------------------------------- --------------- --------------------
/u00/app/oracle/network/wallet/ PASSWORD OPEN_NO_MASTER_KEY
Set Master Key
Now the master key has to defined. When you have already defined a wallet earlier and deleted the keys, you have to set the undocumented parameter to set the master key again. Otherwise you get an ORA-28374: typed master key not found in wallet error. See Master Note For Transparent Data Encryption ( TDE ) (Doc ID 1228046.1) for further information.SQL> ALTER SYSTEM SET "_db_discard_lost_masterkey"=true;
SQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY "my#wallet16" WITH BACKUP USING 'master_key_1';
Now the status is set to OPEN.
SQL> SELECT wrl_parameter, wallet_type, status
2 FROM v$encryption_wallet;
WRL_PARAMETER WALLET_TYPE STATUS
----------------------------------- --------------- --------------------
/u00/app/oracle/network/wallet/ PASSWORD OPEN
Activate Auto Login
SQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE '/u00/app/oracle/network/wallet' IDENTIFIED BY "my#wallet16";Restart Database
SQL> SHUTDOWN IMMEDIATESQL> STARTUP
Verify if the keystore is available and WALLET_TYPE is AUTOLOGIN.
SQL> SELECT wrl_parameter, wallet_type, status2 FROM v$encryption_wallet;
WRL_PARAMETER WALLET_TYPE STATUS
----------------------------------- --------------- --------------------
/u00/app/oracle/network/wallet/ AUTOLOGIN OPEN
Configure RMAN for Encryption
RMAN> CONFIGURE ENCRYPTION FOR DATABASE ON;RMAN Backup Test
A simple RMAN controlfile backup into the Oracle cloud.RUN {
allocate channel t1 type 'sbt_tape' parms='SBT_LIBRARY=libopc.so, SBT_PARMS=(OPC_PFILE=/u00/app/oracle/admin/TVDCRM01/opc_config/opcTVDCRM01.ora)';
backup current controlfile;
release channel t1;
}
Error message if you want to backup into the Oracle cloud and the encryption is not configured correctly:
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03009: failure of backup command on t1 channel at 08/09/2016 11:26:27
ORA-27030: skgfwrt: sbtwrite2 returned error
ORA-19511: non RMAN, but media manager or vendor specific failure, error text:
KBHS-01602: backup piece 65rcqiir_1_1 is not encrypted
Backup Verification in V$BACKUP_PIECE – Column ENCRYPTED
SQL> SELECT start_time,handle,substr(media,1,30),encrypted2 FROM v$backup_piece;
START_TIME HANDLE SUBSTR(MEDIA,1,30) ENC
------------------ ---------------------------------------- ----------------------------------- ---
09-AUG-16 c-1792016933-20160809-01 storage-a418767.storage.oracle YES