Encrypting RMAN backup

Encrypting RMAN backup

Configuring encryption for Oracle Recovery Manager (RMAN) is always a good step in the right direction. There may be different reasons for encrypting RMAN backup.
  •  For greater security of data;
  • Customer requirement (e.g, most companies requires encryption for any database file containing SSN, Credit Card number, date of birth, etc); or
  • Complying with laws or regulations.

Option 1: Use global security wallet to encrypt backup

*configure the encryption wallet.

create a directory called "Wallet" in $ORACLE_BASE/admin/$ORACLE_SID

mkdir /home/oracle/app/oracle/admin/orcl/wallet
*Issue this command as SYS:
SQL> alter system set encryption key identified by "oracle1";
*Open the wallet:

SQL> alter system open encryption wallet identified by "oracle1";
*Log in to rman to encrypt backup

rman target /

RMAN> configure encryption for database on;

RMAN> backup database;


Option 2: Configure encryption right from RMAN

Another option is to configure encryption right from RMAN. You can also decide to use both options 1 and 2 together for double protection. Option one will be global because it controls every encryption done on the database including the backup. Option 2 is only restricted to RMAN prompt alone.

*Log in to RMAN and configure Encryption

RMAN target /

RMAN> set encryption on identified by "oracle1" only;

RMAN> backup database;

Note: You don't need a wallet to implement this. You can combine this with the global wallet transparent backup if you like. That will give you dual protection
You need to specify this password during recovery
  
Removing encryption
 
RMAN> configure encryption for database off;

Note: You need to set encryption off if at any point you don't need to encrypt your backup again. Some organizations will require you to remove encryption for data or databases that are only for TEST or DEVELOPMENT purpose. 

Query encryption setting

Oracle provided a view to track encryption setting configured for recovery manager (RMAN). Issue this command as SYS:

select * from V$RMAN_ENCRYPTION_ALGORITHMS;

This is the view with all the details of rman encryption modes in the database. It is essential for a DBA to understand the encryption mode and their restrictions/limitations.

Comments

Post a Comment

Popular posts from this blog

AWR Reports

AWR Reports Introduction Workload Repository Reports AWR Snapshots and Baselines Moving AWR Information Reading the AWR Report Useful Queries Remove and Disable AWR Links with AWR Analyzer Introduction AWR periodically gathers and stores system activity and workload data which is then analyzed by ADDM. Every layer of Oracle is equipped with instrumentation that gathers information on workload which will then be used to make self-managing decisions. AWR is the place where this data is stored. AWR looks periodically at the system performance (by default every 60 minutes) and stores the information found (by default up to 7 days). AWR runs by default and Oracle states that it does not add a noticeable level of overhead. A new background server process (MMON) takes snapshots of the in-memory database statistics (much like STATSPACK) and stores this information in the repository. MMON also provides Oracle10G with a server initiated alert feature, which notifies database admini
Read more

ORA-01565: error in identifying file '?/dbs/spfile@.ora'

QL> startup ORA-01261: Parameter db_recovery_file_dest destination string cannot be translated SQL> create pfile from spfile; create pfile from spfile * ERROR at line 1: ORA-01565: error in identifying file '?/dbs/spfile@.ora' ORA-27037: unable to obtain file status Linux-x86_64 Error: 2: No such file or directory Additional information: 3   SQL> shut abort SQL> create pfile='/home/oracle/initORA11G.ora' from spfile='+DATA/ORA11G/spfileORA11G.ora'; File created. oracle@rac1.localdomain:/home/oracle [ORA11G1] >dba SQL*Plus: Release 11.2.0.3.0 Production on Wed Apr 6 20:15:29 2016 Copyright (c) 1982, 2011, Oracle.  All rights reserved. Connected to an idle instance. SQL> startup pfile='/home/oracle/initORA11G.ora'; ORACLE instance started. Total System Global Area 1653518336 bytes Fixed Size                  2228904 bytes Variable Size             956304728 bytes Database Buf
Read more

Reboot Exadata Machine

Image
1) Log in to the first database server as root. 2) Change to the OneCommand directory # cd /opt/oracle.SupportTools/onecommand 3) Note whether the Grid Infrastructure is currently enabled for autostart, so that this state can be restored later: # dcli -g dbs_group -l root /u01/app/11.2.0/grid/bin/crsctl config crs 4) Disable the Grid Infrastructure for autostart on the database servers if the previous step indicated it is currently enabled for autostart. # dcli -g dbs_group -l root /u01/app/11.2.0/grid/bin/crsctl disable crs Note: This is step is [Optional] and it can required during maintenance operation like “firmware patches” which requires to reboot the Compute Node several times. 5) Stop the Grid Infrastructure stack on the database servers (compute nodes): # dcli -g dbs_group -l root /u01/app/11.2.0/grid/bin/crsctl stop crs 6) Verify that the Grid Infrastructure stack has shutdown successfully on the database servers. The following
Read more