Several test notes for wallet encryption in Oracle

Oracle Wallet use and maintenance

Starting with ORACLE10GR2, the use of Oracle wallet to reach any user without a password login database (not operating system authentication method) is very useful for scripting database operations, especially for enterprise security requirements, Do not want the user name and password in clear text in the configuration file, and for the maintenance of the password is extremely convenient, such as I put wallet in the specified path, when the password change, only unified coverage wallet can be, for a large number of application server is particularly convenient.

Tde in the comparison of the core of wallet, for this part of the test, wallet encryption has a more profound understanding.

Wallet with library start-up nature
[Oracle@localhost wallets]$ ls-ltr
Total 8
-RW-------1 Oracle oinstall 3637 5 23:11 EWALLET.P12
[Oracle@localhost wallets]$
[Oracle@localhost wallets]$
[Oracle@localhost wallets]$ Sqlplus/as SYSDBA

Sql*plus:release 11.2.0.4.0 Production on Tue 5 23:16:13 2016

Copyright (c) 1982, 2013, Oracle. All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN


sql> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
Sql> Startup
ORACLE instance started.

Total System Global area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database buffers 3992977408 bytes
Redo buffers 8658944 bytes
Database mounted.
Database opened.
Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
CLOSED

[Oracle@localhost wallets]$ orapki wallet CREATE-PWD Xifenfei123-wallet/home/u01/oracle/network/wallets-auto_login
Oracle PKI tool:version 11.2.0.4.0-production
Copyright (c), 2013, Oracle and/or its affiliates. All rights reserved.

[Oracle@localhost wallets]$ ls-ltr
Total 16
-RW-------1 Oracle oinstall 3637 5 23:11 EWALLET.P12
-RW-------1 Oracle oinstall 3715 5 23:20 Cwallet.sso
[Oracle@localhost wallets]$ Sqlplus/as SYSDBA

Sql*plus:release 11.2.0.4.0 Production on Tue 5 23:21:04 2016

Copyright (c) 1982, 2013, Oracle. All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN


sql> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
Sql> Startup
ORACLE instance started.

Total System Global area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database buffers 3992977408 bytes
Redo buffers 8658944 bytes
Database mounted.
Database opened.
Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN

[Oracle@localhost wallets]$ ls
Cwallet.sso EWALLET.P12
[Oracle@localhost wallets]$ RM Cwallet.sso
[Oracle@localhost wallets]$ Sqlplus/as SYSDBA

Sql*plus:release 11.2.0.4.0 Production on Tue 5 23:30:55 2016

Copyright (c) 1982, 2013, Oracle. All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN


sql> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
Sql> Startup
ORACLE instance started.

Total System Global area 5044088832 bytes
Fixed Size 2261928 bytes
Variable Size 1040190552 bytes
Database buffers 3992977408 bytes
Redo buffers 8658944 bytes
Database mounted.
Database opened.
Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
CLOSED

Sql> alter system set wallet open identified by "xifenfei123";

System altered.

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN
Through the test we found that when the wallet contains Cwallet.sso, wallet will start with the library open, when Cwallet.sso is deleted, wallet can not start with the library open, this shows that Whether the wallet is started with the library and open depends on the Cwallet.sso file.

Modify Wallet Password
[Oracle@localhost wallets]$ Orapki Wallet Change_pwd-wallet/home/u01/oracle/network/wallets
>-oldpwd xifenfei123-newpwd www.111cn.net
Oracle PKI tool:version 11.2.0.4.0-production
Copyright (c), 2013, Oracle and/or its affiliates. All rights reserved.

[Oracle@localhost wallets]$ Sqlplus/as SYSDBA

Sql*plus:release 11.2.0.4.0 Production on Tue 5 23:35:01 2016

Copyright (c) 1982, 2013, Oracle. All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options

Sql> alter system set wallet close identified by "xifenfei123";

System altered.

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
CLOSED


Sql> alter system set wallet open identified by "xifenfei123";
Alter system set wallet open identified by "xifenfei123"
*
ERROR at line 1:
ora-28353:failed to open Wallet


Sql> alter system set wallet open identified by "www.111cn.net";

System altered.

Sql> select * from V$encryption_wallet;

Wrl_type
--------------------
Wrl_parameter
--------------------------------------------------------------------------------
STATUS
------------------
File
/home/u01/oracle/network/wallets
OPEN


Sql> exit
Disconnected from Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options
[Oracle@localhost wallets]$ ls-ltr
Total 8
-RW-------1 Oracle oinstall 3638 5 23:34 EWALLET.P12
Wallet file is missing
[Oracle@localhost wallets]$ MV Ewallet.p12 Ewallet.p12_bak
[Oracle@localhost wallets]$ Sqlplus/as SYSDBA

Sql*plus:release 11.2.0.4.0 Production on Tue 5 23:36:55 2016

Copyright (c) 1982, 2013, Oracle. All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition release 11.2.0.4.0-64bit Production
With the partitioning, OLAP, Data Mining and real application testing options

Sql> alter system set wallet close identified by "www.111cn.net";

System altered.

Sql> alter system set wallet open identified by "www.111cn.net";
Alter system set wallet open identified by "Www.111cn.net"
*
ERROR at line 1:
Ora-28367:wallet does not exist


Sql> ALTER SYSTEM SET encryption KEY identified by "www.111cn.net";
ALTER SYSTEM SET Encryption KEY identified by "Www.111cn.net"
*
ERROR at line 1:
Ora-28362:master Key not found


Sql> ALTER SYSTEM SET encryption KEY identified by "Www.xifenfei";
ALTER SYSTEM SET Encryption KEY identified by "Www.xifenfei"
*
ERROR at line 1:
ora-28353:failed to open Wallet
If the wallet file is missing, there is no way to open the wallet, which means the encrypted data cannot be read. Backing up EWALLET.P12 files is important

To login using wallet without password on the client:

1. Create wallet (Tnsname.ora inside the connection string, Sqlnet.ora file content to be copied to the client)
2. Copy the wallet to the client to specify the path (note file permissions and owner)
3. Modify the client's Tnsname.ora file the connection string connecting the server is the connection string created, add the following in the Sqlnet.ora file:

Wallet_location= (Source= (Method=file) (Method_data= (Directory=e:\temp\wallet))
Sqlnet. Wallet_override = TRUE

4. Test in Sqlplus without password
Sqlplus /@skate_192.168.1.9

 

Connects the database password in JDBC form as follows:
   public static Connection getconnection () throws SQLException { br>       Drivermanager.registerdriver (New Oracledriver ());
      Connection conn = DriverManager
               getconnection ("jdbc:oracle:oci:/@tnskate");
      Conn.setautocommit (false);
      return conn;
  }

Contact: Mobile phone (13429648788) QQ (107644445) QQ Advisory Cherish Flying
Title: HTTP://WWW.XIFENFEI.COM/2016/01/about wallet encryption of several tests. HTML