Encrypted RMAN Backup Tips

OracleTipsGotQuestions?KEEPpooldeprecatedin12c12cPosterAvailable!FreeAWRReportAnalysisBEWAREof11gR2UpgradeGotchas!SearchBCOracleSitesSearchHomeEmailUsOracleArticlesOracleTrainingOracleTipsOracleForumClassCatalogRemoteDBAOracleTuningEmergency911RACSupportAppsSupportAnalysisDesignImplementationOracleSupportSQLTuningSecurityOracleUNIXOracleLinuxMonitoringRemotesupportRemoteplansRemoteservicesApplicationServerApplicationsOracleFormsOraclePortalAppUpgradesSQLServerOracleConceptsSoftwareSupportRemoteSupportDevelopmentImplementationConsultingStaffConsultingPricesHelpWanted!OraclePostersEncryptedRMANBackupTipsExpertOracleTipsbyBurlesonConsultingMarch25,2012CreatingEncryptedRMANBackupsandRecoveryItisverysimpletorestorethedatabasecreatedbyRMANusingsimplecommands.Ifsomeonehasstolenthebackupofthedatabase,theycaneasilyrestoreitandstealallourdata,too.Topreventthatfromhappening,encryptthebackupthathasbeenmade.Byqueryingthev$rman_encryption_algorithmsview,alistofRMANencryptionalgorithmscanbeobtained:SQL>selectalgorithm_id,algorithm_name,algorithm_description,is_defaultfromv$rman_encryption_algorithmsALGORITHM_IDALGORITHM_NAMEALGORITHM_DESCRIPTIONIS_DEFAULT1AES128AES128bitkeyYES2AES192AES192bitkeyNO3AES256AES256bitkeyNOSQL>TherearethreeformsofencryptioninOracle10g:transparent,passwordanddualmode.Tousetransparentmodeencryption,OracleEncryptionWalletshouldbeused.Tousepasswordmode,apasswordshouldbeprovidebytheDBAwhichwillbeusedinencryption.Byusingdualmodeencryption,bothabovementionedmodeswillbeused.Inthefollowingexample,wewillshowhowtousepasswordmodetoencryptourbackup.Usethesetencryptiononcommandandthepasswordusingtheidentifiedbycommand,andencryptthebackupthatistakeninthissession.Usetheonlykeywordattheendtouseonlypasswordencryption.Ifthekeywordonlyismissed,RMANusesdualmodeencryptionanddemandsthepresenceofOracleEncryptionWallet,too.RMAN>setencryptiononidentifiedby'test'onlyBackuptheuserstablespace:RMAN>backuptablespaceusersNowtrytorestoreit:RMAN>restoretablespaceusersORA19913:unabletodecryptbackupORA28365:walletisnotopenAsthisshows,itisimpossibletorestorealreadyencryptedbackupwithoutusingthepassword.Inthissituation,ifsomeonehasstolenourbackup,theywillnotbeabletorestoreitandstealourdata,too,withoutprovidingthecorrectpassword.Nowprovidethepasswordandrestorethebackup:OracleBooksOracleScriptsIonExcelDBDonBurlesonBlogRMAN>setdecryptionidentifiedby'test'RMAN>restoretablespaceusersUsingthepassword,tablespaceisrestoredsuccessfully.Ifweprovideawrongpassword,itwillnotrestorethebackup:RMAN>setdecryptionidentifiedby'wrong'#wrongpasswordRMAN>restoretablespaceusersORA19913:unabletodecryptbackupORA28365:walletisnotopenRMAN>Bydefault,RMANusestheAES128bitkeyalgorithmforencryption.Thealgorithmcanbeeasilychangedusingtheconfigureencryptionalgorithmcommandasfollows:RMAN>showencryptionalgorithmRMANconfigurationparametersare:configureencryptionalgorithm'AES128'#defaultRMAN>configureencryptionalgorithm'AES256'newRMANconfigurationparameters:configureencryptionalgorithm'AES256'newRMANconfigurationparametersaresuccessfullystoredRMAN>showencryptionalgorithmRMANconfigurationparametersare:configureencryptionalgorithm'AES256'Again,anytimethisconfigurationiscleared,theencryptionalgorithmcanbereturnedtoitsdefaultvalueasfollows:RMAN>configureencryptionalgorithmclearoldRMANconfigurationparameters:configureencryptionalgorithm'AES256'RMANconfigurationparametersaresuccessfullyresettodefaultvalueRMAN>showencryptionalgorithmRMANconfigurationparametersare:configureencryptionalgorithm'AES128'#defaultRMAN>TouseOracleEncryptionWallet,weneedtoconfigureRMANtoperformanencryptedbackupofanytablespaceorwholedatabaseautomatically.Forthis,usetheconfigureencryptionforcommand.Inthefollowingexample,weconfigureRMANtocreateanencryptedbackupofthedatabase,andexcludeuserstablespacefromencryption:RMAN>showallRMANconfigurationparametersare:configureencryptionfordatabaseoff#defaultconfigureencryptionalgorithm'AES128'#defaultRMAN>configureencryptionfordatabaseonnewRMANconfigurationparameters:configureencryptionfordatabaseonnewRMANconfigurationparametersaresuccessfullystoredRMAN>configureencryptionfortablespaceusersofftablespaceuserswillnotbeencryptedinfuturebackupsetsnewRMANconfigurationparametersaresuccessfullystoredRMAN>showallRMANconfigurationparametersare:configureencryptionfordatabaseonconfigureencryptionalgorithm'AES128'#defaultconfigureencryptionfortablespace'users'offToreturnbacktodefaultvalue,cleartheencryptionconfigurationparameter:RMAN>configureencryptionfordatabaseclearoldRMANconfigurationparameters:configureencryptionfordatabaseonRMANconfigurationparametersaresuccessfullyresettodefaultvalueRMAN>configureencryptionfortablespaceuserscleartablespaceuserswilldefaulttodatabaseencryptionconfigurationoldRMANconfigurationparametersaresuccessfullydeletedRMAN>showallRMANconfigurationparametersare:configureencryptionfordatabaseoff#defaultGettheCompleteOracleBackup&RecoveryDetailsThelandmarkbook"OracleBackup&Recovery:ExpertsecretsforusingRMANandDataPump"providesrealworldadviceforresolvingthemostdifficultOracleperformanceandrecoveryissues.Buyitfor40%offdirectlyfromthepublisher.BurlesonistheAmericanTeamNote:ThisOracledocumentationwascreatedasasupportandOracletrainingreferenceforusebyourDBAperformancetuningconsultingprofessionals.FeelfreetoaskquestionsonourOracleforum.Verifyexperience!AnyoneconsideringusingtheservicesofanOraclesupportexpertshouldindependentlyinvestigatetheircredentialsandexperience,andnotrelyonadvertisementsandselfproclaimedexpertise.AlllegitimateOracleexpertspublishtheirOraclequalifications.Errata?OracletechnologyischangingandwestrivetoupdateourBCOraclesupportinformation.Ifyoufindanerrororhaveasuggestionforimprovingourcontent,wewouldappreciateyourfeedback.Justemail:andincludetheURLforthepage. BurlesonConsultingTheOracleofDatabaseSupportOraclePerformanceTuningRemoteDBAServicesCopyright?19962014AllrightsreservedbyBurlesonOracle?istheregisteredtrademarkofOracleCorporation.