您现在的位置：程式碼之家 >> 數據庫知識 > >> Oracle 資料庫 >> Oracle 資料庫相關知識

Oracle RMAN 備份集加密實戰：SET ENCRYPTION 密碼模式驗證與恢復測試

編輯：Oracle 資料庫相關知識

備份檔若被竊取等同於資料庫被入侵。Oracle 10.2+ Enterprise Edition 提供 SET ENCRYPTION IDENTIFIED BY ... ONLY 密碼模式加密，僅支援 BACKUPSET（不支援 Image Copy），需搭配 OSB (Oracle Secure Backup) 寫入帶庫。本文完整記錄 11.2.0.4 環境下 AES256 加密備份、錯誤密碼拒絕、正確密碼恢復的全流程驗證。

環境基線

SQL> SELECT * FROM v$version;
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
SQL> SHOW PARAMETER compatible
NAME      TYPE   VALUE
compatible string 11.2.0.4.0

支援加密演算法

SQL> SELECT algorithm_name FROM v$rman_encryption_algorithms;
ALGORITHM_NAME
----------------
AES128
AES192
AES256

調整預設演算法為 AES256

RMAN> CONFIGURE ENCRYPTION ALGORITHM 'AES256';
RMAN> SHOW ENCRYPTION ALGORITHM;
CONFIGURE ENCRYPTION ALGORITHM 'AES256';

建立測試資料

SQL> CREATE TABLESPACE rman_xifenfei DATAFILE '/u01/app/oracle/oradata/orcl/xifenfei01.dbf' SIZE 100M;
SQL> CREATE TABLE chf.t_xifenfei TABLESPACE rman_xifenfei AS SELECT * FROM dba_objects;
SQL> SELECT COUNT(*) FROM chf.t_xifenfei;  -- 86721 rows

加密備份執行

RMAN> SET ENCRYPTION ON IDENTIFIED BY 'www.111cn.net' ONLY;
RMAN> BACKUP DATAFILE 5;

Starting backup at 28-JAN-15
allocated channel: ORA_DISK_1
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00005 name=/u01/app/oracle/oradata/orcl/xifenfei01.dbf
channel ORA_DISK_1: starting piece 1 at 28-JAN-15
channel ORA_DISK_1: finished piece 1 at 28-JAN-15
piece handle=/u01/2015_01_28/o1_mf_nnndf_TAG20150128T230115_bdkyfvlw_.bkp
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:01
Finished backup at 28-JAN-15

模擬災難：刪除資料檔

RMAN> SQL 'ALTER DATABASE DATAFILE 5 OFFLINE';
[oracle@localhost ~]$ rm /u01/app/oracle/oradata/orcl/xifenfei01.dbf

恢復測試三階段

1. 無密碼嘗試 → 失敗

RMAN> RESTORE DATAFILE 5;
ORA-19870: error while restoring backup piece ...
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open

2. 錯誤密碼嘗試 → 失敗

RMAN> SET DECRYPTION IDENTIFIED BY 'www.orasos.com';
RMAN> RESTORE DATAFILE 5;
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open

3. 正確密碼恢復 → 成功

RMAN> SET DECRYPTION IDENTIFIED BY 'www.111cn.net';
RMAN> RESTORE DATAFILE 5;
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 28-JAN-15

RMAN> RECOVER DATAFILE 5;
media recovery complete, elapsed time: 00:00:00

RMAN> SQL 'ALTER DATABASE DATAFILE 5 ONLINE';

資料驗證

SQL> SELECT COUNT(*) FROM chf.t_xifenfei;
COUNT(*)
----------
     86721

加密模式對比

模式	語法	金鑰管理	適用場景	優點	缺點
密碼模式	`SET ENCRYPTION IDENTIFIED BY 'pwd' ONLY`	手工輸入/腳本變數	異地備份、雲備份、無 Wallet 基礎設施	簡單、無額外元件、跨平台可移植	腳本含明文密碼風險、大量備份作業需重複輸入
Wallet 模式	`SET ENCRYPTION ON IDENTIFIED BY WALLET`	Oracle Wallet (PKI)	企業標準化備份、自動化腳本、合規要求	無明文密碼、支援證書輪換、集中管理	需部署 Wallet、啟動需開啟 Wallet、單點故障
透明模式	`CONFIGURE ENCRYPTION FOR DATABASE ON`	Wallet 自動開啟	全庫預設加密、零侵入應用	完全透明、無需修改腳本	依賴 Wallet 自動登入、安全性取決於 Wallet 保護