【www.bbyears.com--php函数】
oracle wallet使用与维护
从Oracle10gR2开始, 通过使用Oracle Wallet达到任意用户不使用密码登录数据库(非操作系统认证方式),这对于用脚本登录数据库进行操作来说是非常有用的；尤其对于企业安全要求很高，不希望用户名和密码明文存在配置文件中，而且对于密码的维护是极为方便的，比如我把wallet放在指定路径下，当修改密码时，只需统一覆盖wallet即可，对于有大量应用服务器尤为方便。
TDE中比较核心部分为wallet,对于这部分进行测试,对钱包加密有更加深刻的理解.
wallet随库启动本质
[oracle@localhost wallets]$ ls -ltr
total 8
-rw------- 1 oracle oinstall 3637 Jan 5 23:11 ewallet.p12
[oracle@localhost wallets]$
[oracle@localhost wallets]$
[oracle@localhost wallets]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:16:13 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database Buffers 3992977408 bytes
Redo Buffers 8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
[oracle@localhost wallets]$ orapki wallet create -pwd xifenfei123 -wallet /home/u01/oracle/network/wallets -auto_login
Oracle PKI Tool : Version 11.2.0.4.0 - Production
Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
[oracle@localhost wallets]$ ls -ltr
total 16
-rw------- 1 oracle oinstall 3637 Jan 5 23:11 ewallet.p12
-rw------- 1 oracle oinstall 3715 Jan 5 23:20 cwallet.sso
[oracle@localhost wallets]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:21:04 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database Buffers 3992977408 bytes
Redo Buffers 8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
[oracle@localhost wallets]$ ls
cwallet.sso ewallet.p12
[oracle@localhost wallets]$ rm cwallet.sso
[oracle@localhost wallets]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:30:55 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.
Total System Global Area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database Buffers 3992977408 bytes
Redo Buffers 8658944 bytes
Database mounted.
Database opened.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
SQL> alter system set wallet open identified by "xifenfei123";
System altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
通过测试我们发现当钱包中含cwallet.sso之时,wallet就会随库启动而open,当cwallet.sso被删除之后,wallet无法随库启动而open,由此可见,wallet是否随库启动而open取决于cwallet.sso文件.
修改wallet密码
[oracle@localhost wallets]$ orapki wallet change_pwd -wallet /home/u01/oracle/network/wallets
> -oldpwd xifenfei123 -newpwd www.111cn.net
Oracle PKI Tool : Version 11.2.0.4.0 - Production
Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
[oracle@localhost wallets]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:35:01 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> alter system set wallet close identified by "xifenfei123";
System altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
CLOSED
SQL> alter system set wallet open identified by "xifenfei123";
alter system set wallet open identified by "xifenfei123"
*
ERROR at line 1:
ORA-28353: failed to open wallet
SQL> alter system set wallet open identified by "www.111cn.net";
System altered.
SQL> select * from v$encryption_wallet;
WRL_TYPE
--------------------
WRL_PARAMETER
--------------------------------------------------------------------------------
STATUS
------------------
file
/home/u01/oracle/network/wallets
OPEN
SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
[oracle@localhost wallets]$ ls -ltr
total 8
-rw------- 1 oracle oinstall 3638 Jan 5 23:34 ewallet.p12
wallet文件丢失
[oracle@localhost wallets]$ mv ewallet.p12 ewallet.p12_bak
[oracle@localhost wallets]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 5 23:36:55 2016
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> alter system set wallet close identified by "www.111cn.net";
System altered.
SQL> alter system set wallet open identified by "www.111cn.net";
alter system set wallet open identified by "www.111cn.net"
*
ERROR at line 1:
ORA-28367: wallet does not exist
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.111cn.net";
ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.111cn.net"
*
ERROR at line 1:
ORA-28362: master key not found
SQL> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.xifenfei";
ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "www.xifenfei"
*
ERROR at line 1:
ORA-28353: failed to open wallet
如果wallet文件丢失,没有办法open钱包,也就是说加密数据无法读取.备份ewallet.p12文件非常重要
在客户端使用wallet无密码登录的步骤:
1.创建wallet(tnsname.ora里面的连接串，sqlnet.ora文件内容都要复制到客户端)
2.把wallet复制到客户端指定路径（注意文件权限和属主）
3.修改客户端的tnsname.ora文件里连接服务器的连接串为创建时的连接串，在sqlnet.ora文件里添加如下内容：
WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=e:\temp\wallet)))
SQLNET.WALLET_OVERRIDE = TRUE
4.在sqlplus无密码等里测试
sqlplus /@skate_192.168.1.9
在jdbc里连接数据库密码形式如下：
public static Connection getConnection() throws SQLException {
DriverManager.registerDriver(new OracleDriver());
Connection conn = DriverManager
.getConnection("jdbc:oracle:oci:/@tnskate");
conn.setAutoCommit(false);
return conn;
}
联系：手机(13429648788) QQ(107644445)QQ咨询惜分飞
标题：http://www.xifenfei.com/2016/01/关于wallet加密的几个测试.html