{"id":2613,"date":"2022-02-04T14:43:41","date_gmt":"2022-02-04T13:43:41","guid":{"rendered":"http:\/\/rootfan.com\/?p=2613"},"modified":"2022-04-04T00:24:56","modified_gmt":"2022-04-03T22:24:56","slug":"encriptacion-transparente-de-datos-oracle-19c","status":"publish","type":"post","link":"https:\/\/rootfan.com\/es\/transparent-data-encryption-oracle-19c\/","title":{"rendered":"Implementaci\u00f3n de Cifrado Transparente de Datos en Oracle 19c Paso a Paso"},"content":{"rendered":"

El Cifrado Transparente de Datos (TDE) permite cifrar los datos confidenciales almacenados en tablas y tablespaces.<\/p>\n\n\n\n

Una vez cifrados los datos, estos se descifran de forma transparente para los usuarios o aplicaciones autorizados cuando acceden a ellos. TDE ayuda a proteger los datos almacenados en soportes (tambi\u00e9n llamados datos en reposo) en caso de robo del soporte de almacenamiento o del archivo de datos.<\/p>\n\n\n\n

En esta gu\u00eda te mostrar\u00e9 c\u00f3mo implementar Oracle TDE en RAC, pero deber\u00edas ser capaz de modificar el procedimiento para una base de datos independiente.<\/p>\n\n\n\n\n\n\n\n

Compruebe que el wallet_root no est\u00e1 configurado.<\/p>\n\n\n

\nSQL> show parameter wallet_root\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\nwallet_root                          string\n<\/pre><\/div>\n\n\n
Ahora aseg\u00farese de que ha definido db_create_file_dest<\/p>\n\n\n
\nSQL> show parameter db_create_file\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\ndb_create_file_dest                  string      +DATAC3\n<\/pre><\/div>\n\n\n
Establecer la ra\u00edz del monedero<\/p>\n\n\n
\nalter system set wallet_root='+DATAC3\/LSG01' scope=spfile sid='*';\n<\/pre><\/div>\n\n\n
Reinicie la BD para que los cambios surtan efecto<\/p>\n\n\n
\n[oracle@xcm1iddb001 ~]$ srvctl stop database -d LSG01\n[oracle@xcm1iddb001 ~]$ srvctl start database -d LSG01\n<\/pre><\/div>\n\n\n
Compruebe que se han ajustado los par\u00e1metros.<\/p>\n\n\n
\nshow parameter wallet_root\n\nshow parameter tde_configuration\n<\/pre><\/div>\n\n\n
Establezca la tde_configuration<\/p>\n\n\n
\nalter system set tde_configuration="keystore_configuration=file" scope=both sid='*';\n\nSQL> show parameter tde_configuration\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\ntde_configuration                    string      keystore_configuration=file\n<\/pre><\/div>\n\n\n
Crear el almac\u00e9n de claves<\/p>\n\n\n
\nSQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY BSLSG01;\n\nkeystore altered.\n<\/pre><\/div>\n\n\n
Abrir el almac\u00e9n de claves<\/p>\n\n\n
\n-- with PDBs\nSQL> ADMINISTER KEY MANAGEMENT set keystore open identified by BSLSG01 container=ALL;\n\nkeystore altered.\n\n-- without PDBs\nADMINISTER KEY MANAGEMENT set keystore open identified by BSLSG01;\n<\/pre><\/div>\n\n\n
Ajuste la tecla<\/p>\n\n\n
\n-- with PDBs\nSQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY BSLSG01 with backup container=ALL;\n\nkeystore altered.\n\n--without PDBs\nADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY BSLSG01 with backup;\n<\/pre><\/div>\n\n\n
Activar inicio de sesi\u00f3n autom\u00e1tico<\/p>\n\n\n
\n-- auto login\nSQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY BSLSG01;\n\nkeystore altered.\n\nset linesize 120\ncolumn STATUS format a20\ncolumn WRL_PARAMETER format a60\ncolumn MASTERKEY_ACTIVATED format a20\ncolumn WALLET_TYPE format a20\n\nSQL> SELECT CON_ID, STATUS, WRL_PARAMETER,WALLET_TYPE FROM V$ENCRYPTION_WALLET;\n\n    CON_ID STATUS               WRL_PARAMETER                                                WALLET_TYPE\n---------- -------------------- ------------------------------------------------------------ --------------------\n         1 OPEN                 +DATAC3\/LSG01\/tde\/                                           PASSWORD\n         2 OPEN                                                                              PASSWORD\n         4 OPEN                                                                              PASSWORD\n<\/pre><\/div>\n\n\n
De la consulta anterior se puede comprobar que todav\u00eda no es autologin.<\/p>\n\n\n\n
Tienes que hacerlo autologin.<\/p>\n\n\n\n
Reinicie la base de datos e intente de nuevo la consulta<\/p>\n\n\n
\n[oracle@xcm1iddb001 ~]$ srvctl stop database -d LSG01\n[oracle@xcm1iddb001 ~]$ srvctl start database -d LSG01\n\nset linesize 120\ncolumn STATUS format a20\ncolumn WRL_PARAMETER format a60\ncolumn MASTERKEY_ACTIVATED format a20\ncolumn WALLET_TYPE format a20\n\nSELECT CON_ID, STATUS, WRL_PARAMETER,WALLET_TYPE FROM V$ENCRYPTION_WALLET;\n\n    CON_ID STATUS               WRL_PARAMETER                                                WALLET_TYPE\n---------- -------------------- ------------------------------------------------------------ --------------------\n         1 OPEN                 +DATAC3\/LSG01\/tde\/                                           AUTOLOGIN\n         2 OPEN                                                                              AUTOLOGIN\n         4 OPEN                                                                              AUTOLOGIN\n<\/pre><\/div>\n\n\n
Activar la encriptaci\u00f3n para nuevos tablespaces<\/p>\n\n\n
\nalter system set encrypt_new_tablespaces = always scope=both sid='*';\n\nALTER SYSTEM SET "_tablespace_encryption_default_algorithm"=AES256 scope=both sid='*';\n<\/pre><\/div>\n\n\n
Comprobar si hay tablespaces encriptados<\/p>\n\n\n
\nselect TABLESPACE_NAME, ENCRYPTED from dba_tablespaces where ENCRYPTED='YES';\n\nselect TABLESPACE_NAME, ENCRYPTED from dba_tablespaces order by 1;\n<\/pre><\/div>\n\n\n
Supongamos que desea cifrar todos los tablespaces de un esquema.<\/p>\n\n\n\n
Comprobar en qu\u00e9 tablespaces tiene objetos ese esquema<\/p>\n\n\n
\nSQL> select distinct tablespace_name \nfrom dba_segments where owner='SCHEMA1';\n\nTABLESPACE_NAME\n------------------------------\nTS_SGRI_IDX\nTS_SGRI_DAT\n<\/pre><\/div>\n\n\n
Para encriptar un tablespace basta con utilizar este comando<\/p>\n\n\n
\nalter tablespace TS_SGRI_DAT encryption online encrypt;\n<\/pre><\/div>\n\n\n
Haga lo mismo con los dem\u00e1s tablespaces.<\/p>\n\n\n\n
Si s\u00f3lo desea cifrar una columna de la tabla, utilice este comando<\/p>\n\n\n
\nALTER TABLE schema.table MODIFY (column ENCRYPT);\n<\/pre><\/div>\n\n\n
Ten en cuenta que el cifrado de columnas de la tabla tiene un cifrado por defecto de AES192.<\/p>\n\n\n\n
Si desea cifrar sus tablas con AES256, debe especificar el tipo de cifrado en el comando de la siguiente manera<\/p>\n\n\n
\nALTER TABLE schema.table MODIFY (column ENCRYPT USING 'AES256');\n<\/pre><\/div>\n\n\n
Para comprobar las columnas que han sido encriptadas ejecute esta consulta<\/p>\n\n\n
\ncolumn table_name format a15;\ncolumn column_name format a15;\ncolumn encryption_alg format a20;\n\nselect table_name , column_name, encryption_alg  from dba_encrypted_columns;\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"
El cifrado transparente de datos (TDE) permite cifrar los datos confidenciales almacenados en tablas y tablespaces. Una vez cifrados los datos, estos se descifran de forma transparente para los usuarios o aplicaciones autorizados cuando acceden a ellos. TDE ayuda a proteger los datos almacenados en soportes (tambi\u00e9n llamados datos en reposo) en caso de que el almacenamiento ... <\/p>\n
Seguir leyendo \"Implementaci\u00f3n de Cifrado Transparente de Datos en Oracle 19c Paso a Paso\"<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":2933,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_focus_keyword":"Transparent Data Encryption in Oracle 19c","rank_math_title":"","rank_math_description":"Step-by-step guide to implementing Transparent Data Encryption in Oracle 19c for enhanced data security.","rank_math_robots":"","rank_math_og_title":"","rank_math_og_description":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[31],"tags":[85,84],"class_list":["post-2613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oracle","tag-encryption","tag-tde"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/rootfan.com\/wp-content\/uploads\/pexels-photo-1201673.jpeg?fit=1880%2C1056&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/posts\/2613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/comments?post=2613"}],"version-history":[{"count":22,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/posts\/2613\/revisions"}],"predecessor-version":[{"id":2706,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/posts\/2613\/revisions\/2706"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/media\/2933"}],"wp:attachment":[{"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/media?parent=2613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/categories?post=2613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rootfan.com\/es\/wp-json\/wp\/v2\/tags?post=2613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}