Data-At-Rest Encryption for Oracle database

 As part of database security, DBA need to enable encryption for the database. In this blog, we will go through the steps for encryption at rest in oracle database. 

Step 1) Add following entry in sqlnet.ora on all node of RAC cluster. 

Step 2) Create TDE directory on all the nodes on the cluster.

 mkdir -p $ORACLE_BASE/tde/$ORACLE_SID

Step 3) Create Wallet and Encrption key. 



SQL>

prompt Creating the Password based Key Store

prompt

administer key management create keystore '$ORACLE_BASE/tde/$ORACLE_SID' identified by "<Master Key>;

prompt Opening the Password based Key Store

prompt

administer key management set keystore open identified by "<Master Key>";

prompt Creating and Setting the Master Encryption Key

prompt

administer key management set key identified by "<Master Key>" with backup using 'TDE';

prompt Creating the auto-login for Key Store

prompt

administer key management create auto_login keystore from keystore '$ORACLE_BASE/tde/$ORACLE_SID' identified by "<Master Key>";

Step 4) Copy wallet and auto login files on all cluster node and standby database node (if any)

Step 5) Verify the wallet status. 
SQL> Select * from gv$encryption_wallet; 

Make sure wallet is open and wallet_type is autologin. 

Step 6) Encrypt the tablespace using below commads.

Alter tablespace <Tablespace name> encryption online using 'AES256' encrypt;

Step 7) USE DBV to verify that datafiles have been encrypted.

dbv file='datafile path' userid=/

Step 8) Login to database to check datafiles and tablespace encryption. 



Select tablespace_name,status,encrypted from dba_tablespaces order by tablespace_name;

Select a.name, b.encryptionalg, b.encryptedts, b.encryptedkey from v$tablespace a, v$encrypted_tablespaces b where a.ts#=b.ts# order by a.name;

You can learn more about oracle database administration: 

Oracle Security Tools Installation and Configuration

Expert Oracle Exadata 

Oracle Database 12c Release 2 Real Application Clusters Handbook: Concepts, Administration, Tuning & Troubleshooting

Expert Oracle RAC 12c

==========================================================

Please check our other blogs for Security & TDE.