{"id":2613,"date":"2022-02-04T14:43:41","date_gmt":"2022-02-04T13:43:41","guid":{"rendered":"http:\/\/rootfan.com\/?p=2613"},"modified":"2022-04-04T00:24:56","modified_gmt":"2022-04-03T22:24:56","slug":"cryptage-transparent-des-donnees-oracle-19c","status":"publish","type":"post","link":"https:\/\/rootfan.com\/fr\/transparent-data-encryption-oracle-19c\/","title":{"rendered":"Mise en \u0153uvre du chiffrement transparent des donn\u00e9es dans Oracle 19c, \u00e9tape par \u00e9tape"},"content":{"rendered":"

Le chiffrement transparent des donn\u00e9es (TDE) vous permet de chiffrer les donn\u00e9es sensibles que vous stockez dans les tables et les tablespaces.<\/p>\n\n\n\n

Une fois les donn\u00e9es chiffr\u00e9es, elles sont d\u00e9chiffr\u00e9es de mani\u00e8re transparente pour les utilisateurs ou applications autoris\u00e9s lorsqu'ils acc\u00e8dent \u00e0 ces donn\u00e9es. Le TDE permet de prot\u00e9ger les donn\u00e9es stock\u00e9es sur un support (\u00e9galement appel\u00e9es donn\u00e9es au repos) en cas de vol du support de stockage ou du fichier de donn\u00e9es.<\/p>\n\n\n\n

Dans ce guide, je vais vous montrer comment impl\u00e9menter Oracle TDE sur RAC, mais vous devriez \u00eatre capable de modifier la proc\u00e9dure pour une base de donn\u00e9es autonome.<\/p>\n\n\n\n\n\n\n\n

V\u00e9rifier que le wallet_root n'est pas d\u00e9fini.<\/p>\n\n\n

\nSQL> show parameter wallet_root\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\nwallet_root                          string\n<\/pre><\/div>\n\n\n
Assurez-vous maintenant que vous avez d\u00e9fini db_create_file_dest<\/p>\n\n\n
\nSQL> show parameter db_create_file\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\ndb_create_file_dest                  string      +DATAC3\n<\/pre><\/div>\n\n\n
D\u00e9finir la racine du portefeuille<\/p>\n\n\n
\nalter system set wallet_root='+DATAC3\/LSG01' scope=spfile sid='*';\n<\/pre><\/div>\n\n\n
Red\u00e9marrer la base de donn\u00e9es pour que les modifications soient prises en compte.<\/p>\n\n\n
\n[oracle@xcm1iddb001 ~]$ srvctl stop database -d LSG01\n[oracle@xcm1iddb001 ~]$ srvctl start database -d LSG01\n<\/pre><\/div>\n\n\n
V\u00e9rifiez que les param\u00e8tres ont \u00e9t\u00e9 d\u00e9finis.<\/p>\n\n\n
\nshow parameter wallet_root\n\nshow parameter tde_configuration\n<\/pre><\/div>\n\n\n
D\u00e9finir la configuration tde_configuration<\/p>\n\n\n
\nalter system set tde_configuration="keystore_configuration=file" scope=both sid='*';\n\nSQL> show parameter tde_configuration\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\ntde_configuration                    string      keystore_configuration=file\n<\/pre><\/div>\n\n\n
Cr\u00e9er la base de donn\u00e9es de cl\u00e9s<\/p>\n\n\n
\nSQL> ADMINISTER KEY MANAGEMENT CREATE KEYSTORE IDENTIFIED BY BSLSG01;\n\nkeystore altered.\n<\/pre><\/div>\n\n\n
Ouvrir le d\u00e9p\u00f4t de cl\u00e9s<\/p>\n\n\n
\n-- with PDBs\nSQL> ADMINISTER KEY MANAGEMENT set keystore open identified by BSLSG01 container=ALL;\n\nkeystore altered.\n\n-- without PDBs\nADMINISTER KEY MANAGEMENT set keystore open identified by BSLSG01;\n<\/pre><\/div>\n\n\n
R\u00e9gler la cl\u00e9<\/p>\n\n\n
\n-- with PDBs\nSQL> ADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY BSLSG01 with backup container=ALL;\n\nkeystore altered.\n\n--without PDBs\nADMINISTER KEY MANAGEMENT SET KEY IDENTIFIED BY BSLSG01 with backup;\n<\/pre><\/div>\n\n\n
Activer la connexion automatique<\/p>\n\n\n
\n-- auto login\nSQL> ADMINISTER KEY MANAGEMENT CREATE AUTO_LOGIN KEYSTORE FROM KEYSTORE IDENTIFIED BY BSLSG01;\n\nkeystore altered.\n\nset linesize 120\ncolumn STATUS format a20\ncolumn WRL_PARAMETER format a60\ncolumn MASTERKEY_ACTIVATED format a20\ncolumn WALLET_TYPE format a20\n\nSQL> SELECT CON_ID, STATUS, WRL_PARAMETER,WALLET_TYPE FROM V$ENCRYPTION_WALLET;\n\n    CON_ID STATUS               WRL_PARAMETER                                                WALLET_TYPE\n---------- -------------------- ------------------------------------------------------------ --------------------\n         1 OPEN                 +DATAC3\/LSG01\/tde\/                                           PASSWORD\n         2 OPEN                                                                              PASSWORD\n         4 OPEN                                                                              PASSWORD\n<\/pre><\/div>\n\n\n
A partir de la requ\u00eate ci-dessus, vous pouvez v\u00e9rifier qu'il n'y a toujours pas d'autologin.<\/p>\n\n\n\n
Vous devez faire en sorte qu'il s'agisse d'un autologin.<\/p>\n\n\n\n
Red\u00e9marrez la base de donn\u00e9es et r\u00e9essayez la requ\u00eate<\/p>\n\n\n
\n[oracle@xcm1iddb001 ~]$ srvctl stop database -d LSG01\n[oracle@xcm1iddb001 ~]$ srvctl start database -d LSG01\n\nset linesize 120\ncolumn STATUS format a20\ncolumn WRL_PARAMETER format a60\ncolumn MASTERKEY_ACTIVATED format a20\ncolumn WALLET_TYPE format a20\n\nSELECT CON_ID, STATUS, WRL_PARAMETER,WALLET_TYPE FROM V$ENCRYPTION_WALLET;\n\n    CON_ID STATUS               WRL_PARAMETER                                                WALLET_TYPE\n---------- -------------------- ------------------------------------------------------------ --------------------\n         1 OPEN                 +DATAC3\/LSG01\/tde\/                                           AUTOLOGIN\n         2 OPEN                                                                              AUTOLOGIN\n         4 OPEN                                                                              AUTOLOGIN\n<\/pre><\/div>\n\n\n
Activer le cryptage pour les nouveaux tablespaces<\/p>\n\n\n
\nalter system set encrypt_new_tablespaces = always scope=both sid='*';\n\nALTER SYSTEM SET "_tablespace_encryption_default_algorithm"=AES256 scope=both sid='*';\n<\/pre><\/div>\n\n\n
V\u00e9rifier s'il existe des tablespaces crypt\u00e9s<\/p>\n\n\n
\nselect TABLESPACE_NAME, ENCRYPTED from dba_tablespaces where ENCRYPTED='YES';\n\nselect TABLESPACE_NAME, ENCRYPTED from dba_tablespaces order by 1;\n<\/pre><\/div>\n\n\n
Supposons que vous souhaitiez crypter tous les tablespaces d'un sch\u00e9ma.<\/p>\n\n\n\n
V\u00e9rifier sur quels tablespaces ce sch\u00e9ma a des objets<\/p>\n\n\n
\nSQL> select distinct tablespace_name \nfrom dba_segments where owner='SCHEMA1';\n\nTABLESPACE_NAME\n------------------------------\nTS_SGRI_IDX\nTS_SGRI_DAT\n<\/pre><\/div>\n\n\n
Pour crypter un tablespace, il suffit d'utiliser la commande suivante<\/p>\n\n\n
\nalter tablespace TS_SGRI_DAT encryption online encrypt;\n<\/pre><\/div>\n\n\n
Faites de m\u00eame pour les autres tablespaces.<\/p>\n\n\n\n
Si vous souhaitez simplement crypter une colonne de tableau, vous devez utiliser la commande suivante<\/p>\n\n\n
\nALTER TABLE schema.table MODIFY (column ENCRYPT);\n<\/pre><\/div>\n\n\n
N'oubliez pas que le cryptage des colonnes de la table est par d\u00e9faut de type AES192.<\/p>\n\n\n\n
Si vous souhaitez crypter vos tables avec AES256, vous devez sp\u00e9cifier le type de cryptage dans la commande comme suit<\/p>\n\n\n
\nALTER TABLE schema.table MODIFY (column ENCRYPT USING 'AES256');\n<\/pre><\/div>\n\n\n
Pour v\u00e9rifier les colonnes qui ont \u00e9t\u00e9 crypt\u00e9es, ex\u00e9cutez la requ\u00eate suivante<\/p>\n\n\n
\ncolumn table_name format a15;\ncolumn column_name format a15;\ncolumn encryption_alg format a20;\n\nselect table_name , column_name, encryption_alg  from dba_encrypted_columns;\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"
Le chiffrement transparent des donn\u00e9es (TDE) vous permet de chiffrer les donn\u00e9es sensibles que vous stockez dans les tables et les tablespaces. Une fois les donn\u00e9es chiffr\u00e9es, elles sont d\u00e9chiffr\u00e9es de mani\u00e8re transparente pour les utilisateurs ou applications autoris\u00e9s lorsqu'ils acc\u00e8dent \u00e0 ces donn\u00e9es. Le TDE permet de prot\u00e9ger les donn\u00e9es stock\u00e9es sur des supports (\u00e9galement appel\u00e9es donn\u00e9es au repos) dans l'\u00e9ventualit\u00e9 o\u00f9 le ... <\/p>\n
Continuer la lecture de \" Mise en \u0153uvre du chiffrement transparent des donn\u00e9es dans Oracle 19c, \u00e9tape par \u00e9tape \"<\/span><\/a><\/p>","protected":false},"author":1,"featured_media":2933,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_focus_keyword":"Transparent Data Encryption in Oracle 19c","rank_math_title":"","rank_math_description":"Step-by-step guide to implementing Transparent Data Encryption in Oracle 19c for enhanced data security.","rank_math_robots":"","rank_math_og_title":"","rank_math_og_description":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[31],"tags":[85,84],"class_list":["post-2613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oracle","tag-encryption","tag-tde"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/rootfan.com\/wp-content\/uploads\/pexels-photo-1201673.jpeg?fit=1880%2C1056&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/posts\/2613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/comments?post=2613"}],"version-history":[{"count":22,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/posts\/2613\/revisions"}],"predecessor-version":[{"id":2706,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/posts\/2613\/revisions\/2706"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/media\/2933"}],"wp:attachment":[{"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/media?parent=2613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/categories?post=2613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rootfan.com\/fr\/wp-json\/wp\/v2\/tags?post=2613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}