Oracle TDE Tablespace Encryption

(1)

Best Practice

Document Version: 1.0 – 2015-02-04

CUSTOMER

Oracle TDE Tablespace Encryption

(2)

Document History

Version Date Change

(3)

1 General Information

Caution

There may be slight differences depending on your OS and DB version.

Note

This document was created with the help of SAP note 974876. For a complete description please refer to that note.

OS Platform: Oracle Linux R6 DB Release: 11.2.0.3

(5)

2 SAP Note reference

 974876 - Oracle Transparent Data Encryption (TDE)

 1398634 - Oracle database 11g: Integration in SAP environment

 740897 - Info about the Oracle license scope; Required Oracle options

(6)

3 Prerequisites

 Oracle Release 11.2

 Advanced Security Option

(7)

4 Preparations

4.1 Create a backup of sqlnet.ora (also in $ORACLE_HOME)

testserver:ol1adm 58> cp /usr/sap/OL1/SYS/profile/oracle/sqlnet.ora

/usr/sap/OL1/SYS/profile/oracle/sqlnet.ora.SAVE

testserver:ol1adm 59> ls -al /usr/sap/OL1/SYS/profile/oracle total 20

drwxr-xr-x. 2 ol1adm sapsys 4096 Jan 19 14:36 . drwxr-xr-x. 3 ol1adm sapsys 4096 Feb 11 2014 .. -rw-r--r--. 1 ol1adm sapsys 500 Jun 5 2014 sqlnet.ora -rw-r--r--. 1 ol1adm sapsys 500 Jan 19 14:36 sqlnet.ora.SAVE -rw-r--r--. 1 ol1adm sapsys 497 Jun 5 2014 tnsnames.ora

4.2 Supplement ENCRYPTION_WALLET_LOCATION in

sqlnet.ora

################ # Filename...: sqlnet.ora

# Created...: created by SAP AG, R/3 Rel. >= 6.10 # Name...: # Date...: # @(#) $Id: //bas/720_REL/src/krn/tpls/ora/SQLNET.ORA#1 $ ################ AUTOMATIC_IPC = ON TRACE_LEVEL_CLIENT = OFF NAMES.DEFAULT_DOMAIN = WORLD # 05.01.06 unsorported parameter now #NAME.DEFAULT_ZONE = WORLD # 05.01.06 set the default to 10 SQLNET.EXPIRE_TIME = 10 # 05.01.06 set to default #TCP.NODELAY=YES # 05.01.06 set to 32768 DEFAULT_SDU_SIZE=32768

(8)

################################################ # Encryption Wallet Location

################################################

ENCRYPTION_WALLET_LOCATION =(SOURCE =(METHOD = FILE) (METHOD_DATA =(DIRECTORY = /oracle/OL1/112_64/dbs )))

4.3 Check whether the path in

ENCRYPTION_WALLET_LOCATION exists and the Oracle

user also has write authorization for it.

testserver:oraol1 52> ls -l $ORACLE_HOME/dbs total 140

-rw-rw----. 1 oraol1 dba 1544 Jan 8 12:46 hc_OL1.dat

-rwxrwxr-x. 1 oraol1 dba 27993 Mar 7 2014 initOL1_backint.sap -rw-r---. 1 oraol1 dba 2829 Sep 23 13:48 initOL1.ora

-rwxrwxr-x. 1 oraol1 dba 27997 May 22 2014 initOL1_rman.sap -rwxrwxr-x. 1 oraol1 dba 28037 Mar 7 2014 initOL1_rmansbt.sap -rwxrwxr-x. 1 oraol1 dba 27988 Feb 6 2014 initOL1.sap

-rw-r--r--. 1 oraol1 dba 2851 May 15 2009 init.ora -rw-r---. 1 oraol1 dba 24 Mar 13 2014 lkOL1 -rw-r---. 1 oraol1 dba 2048 Mar 13 2014 orapwOL1 -rw-r---. 1 oraol1 dba 5632 Jun 13 2014 spfileOL1.ora

testserver:oraol1 53> touch $ORACLE_HOME/dbs/write_test testserver:oraol1 54> ls -l $ORACLE_HOME/dbs/write_test

-rw-r--r--. 1 oraol1 dba 0 Jan 19 14:42 /oracle/OL1/112_64/dbs/write_test testserver:oraol1 55> rm $ORACLE_HOME/dbs/write_test

testserver:oraol1 56> ls -l $ORACLE_HOME/dbs/write_test

ls: cannot access /oracle/OL1/112_64/dbs/write_test: No such file or directory

4.4 Restart Database

SQL> shutdown immediate;

Database closed. Database dismounted. ORACLE instance shut down. SQL> startup

ORA-32004: obsolete or deprecated parameter(s) specified for RDBMS instance ORACLE instance started.

(9)

Total System Global Area 1135820800 bytes Fixed Size 2252504 bytes Variable Size 570425640 bytes Database Buffers 553648128 bytes

Redo Buffers 9494528 bytes Database mounted.

Database opened.

4.5 Check if Wallet Directory was recognized by the database

(below statement should show DIRECTORY in column

WRL_PARAMETER)

testserver:oraol1 76> brspace -u / -f mdencr -a show BR1001I BRSPACE 7.40 (8)

BR1002I Start of BRSPACE processing: seprfepk.mde 2015-01-20 09:42:00 BR0484I BRSPACE log file: /oracle/OL1/sapreorg/seprfepk.mde

BR1304W Checking SAP license failed at location BrLicCheck-109 BR0602W No valid SAP license found - please contact SAP BR0280I BRSPACE time stamp: 2015-01-20 09:42:02 BR1009I Name of database instance: OL1

BR1010I BRSPACE action ID: seprfepk BR1011I BRSPACE function ID: mde BR1012I BRSPACE function: mdencr

BR0280I BRSPACE time stamp: 2015-01-20 09:42:04 BR0692I Display menu 446 # no input possible

--- Status of data encryption of database OL1

1 - Database encryption wallet (wallet) ... /oracle/OL1/112_64/dbs/ewallet.p12 2 - Database auto-open wallet (auto_wallet) ...

3 - Database wallet status (status) ... NOT_AVAIL 4 - Number of encrypted tables/columns (tab_col) ... 0/0 5 - Number of encrypted tablespaces/tables (tsp_tab) . 0/0 Standard keys: c - cont, b - back, s - stop, r - refr

(10)

BR0662I Enter your choice: c

BR0280I BRSPACE time stamp: 2015-01-20 09:42:11 BR0663I Your choice: 'c'

BR0259I Program execution will be continued... BR0280I BRSPACE time stamp: 2015-01-20 09:42:11 BR1003I BRSPACE function 'mdencr' completed

BR1008I End of BRSPACE processing: seprfepk.mde 2015-01-20 09:42:11 BR0280I BRSPACE time stamp: 2015-01-20 09:42:11

BR1006I BRSPACE completed successfully with warnings OR

SQL> SET PAGESIZE 100 SET LINESIZE 200

COL STATUS FORMAT A10

COL WRL_PARAMETER FORMAT A50

SELECT WRL_PARAMETER, STATUS FROM V$ENCRYPTION_WALLET;

WRL_PARAMETER STATUS

--- ---

/oracle/OL1/112_64/dbs CLOSED

4.6 Create Encryption Wallet

testserver:oraol1 78> brspace -u / -f mdencr -a create BR1001I BRSPACE 7.40 (8)

BR1002I Start of BRSPACE processing: seprfesf.mde 2015-01-20 09:43:13 BR0484I BRSPACE log file: /oracle/OL1/sapreorg/seprfesf.mde

BR1010I BRSPACE action ID: seprfesf BR1011I BRSPACE function ID: mde BR1012I BRSPACE function: mdencr

(11)

BR0280I BRSPACE time stamp: 2015-01-20 09:43:14 BR0657I Input menu 442 - please enter/check input values --- Options for managing data encryption of database OL1

1 * Database encryption wallet (wallet) ... [/oracle/OL1/112_64/dbs/ewallet.p12] 2 * Database auto-open wallet (auto_wallet) . []

3 * Database wallet status (status) ... [NOT_AVAIL] 4 * Manage encryption action (action) ... [create] 5 # Encrypted tables for re-key (table) ... [] 6 ? Wallet password (password) ... [] 7 # New wallet password (newpass) ... [] 8 # Encryption algorithm (algorithm) ... [] 9 # Force re-key action (force) ... [no] 10 # Local auto-open wallet (local) ... [yes]

11 - SQL command (command) ... [alter system set encryption key identified by ""] Standard keys: c - cont, b - back, s - stop, r - refr

--- BR0662I Enter your choice:

6

BR0280I BRSPACE time stamp: 2015-01-20 09:43:18 BR0663I Your choice: '6'

BR0280I BRSPACE time stamp: 2015-01-20 09:43:18

BR1700I Enter password for encryption wallet (max. 30 ASCII chars): BR0280I BRSPACE time stamp: 2015-01-20 09:43:20

BR1700I Reenter password for encryption wallet (max. 30 ASCII chars):

3 * Database wallet status (status) ... [NOT_AVAIL] 4 * Manage encryption action (action) ... [create] 5 # Encrypted tables for re-key (table) ... []

(12)

6 - Wallet password (password) ... [********] 7 # New wallet password (newpass) ... [] 8 # Encryption algorithm (algorithm) ... [] 9 # Force re-key action (force) ... [no] 10 # Local auto-open wallet (local) ... [yes]

11 - SQL command (command) ... [alter system set encryption key identified by "********"] Standard keys: c - cont, b - back, s - stop, r - refr

c

BR0259I Program execution will be continued...

BR0370I Directory /oracle/OL1/sapwallet/seprfesf created BR0280I BRSPACE time stamp: 2015-01-20 09:43:28

BR1016I SQL statement 'alter system set encryption key identified by "********"' executed successfully BR1714I Encryption wallet /oracle/OL1/112_64/dbs/ewallet.p12 created successfully

BR0202I Copying /oracle/OL1/112_64/dbs/ewallet.p12 BR0203I to /oracle/OL1/112_64/dbs/ewallet.cpy ... BR0202I Copying /oracle/OL1/112_64/dbs/ewallet.p12 BR0203I to /oracle/OL1/sapwallet/seprfesf/ewallet.new ... BR0280I BRSPACE time stamp: 2015-01-20 09:43:28

BR0670I Enter 'c[ont]' to continue, 'b[ack]' to go back, 's[top]' to abort: c

BR0280I BRSPACE time stamp: 2015-01-20 09:43:33 BR0257I Your reply: 'c'

BR1008I End of BRSPACE processing: seprfesf.mde 2015-01-20 09:43:33 BR0280I BRSPACE time stamp: 2015-01-20 09:43:33

(13)

4.7 Check Encryption Wallet again (now, result should show

you 'OPEN', if not check steps before and the syntax in

sqlnet.ora)

testserver:oraol1 80> brspace -u / -f mdencr -a show BR1001I BRSPACE 7.40 (8)

BR1002I Start of BRSPACE processing: seprfevr.mde 2015-01-20 09:44:43 BR0484I BRSPACE log file: /oracle/OL1/sapreorg/seprfevr.mde

BR1010I BRSPACE action ID: seprfevr BR1011I BRSPACE function ID: mde BR1012I BRSPACE function: mdencr

BR0280I BRSPACE time stamp: 2015-01-20 09:44:44 BR0692I Display menu 446 # no input possible

--- Status of data encryption of database OL1

1 - Database encryption wallet (wallet) ... /oracle/OL1/112_64/dbs/ewallet.p12 2 - Database auto-open wallet (auto_wallet) ...

3 - Database wallet status (status) ... OPEN 4 - Number of encrypted tables/columns (tab_col) ... 0/0 5 - Number of encrypted tablespaces/tables (tsp_tab) . 0/0 Standard keys: c - cont, b - back, s - stop, r - refr

c

(14)

BR0280I BRSPACE time stamp: 2015-01-20 09:44:46 BR1006I BRSPACE completed successfully with warnings OR

SQL> select STATUS, WRL_PARAMETER from v$encryption_wallet; STATUS WRL_PARAMETER

--- --- OPEN /oracle/OL1/112_64/dbs

4.8 Save Encryption Wallet

testserver:oraol1 83> brspace -f mdencr -a save BR1001I BRSPACE 7.40 (8)

BR1002I Start of BRSPACE processing: seprffjv.mde 2015-01-20 09:50:51 BR0484I BRSPACE log file: /oracle/OL1/sapreorg/seprffjv.mde

BR1010I BRSPACE action ID: seprffjv BR1011I BRSPACE function ID: mde BR1012I BRSPACE function: mdencr

3 * Database wallet status (status) ... [OPEN] 4 * Manage encryption action (action) ... [save] 5 # Encrypted tables for re-key (table) ... [] 6 # Wallet password (password) ... [] 7 # New wallet password (newpass) ... [] 8 # Encryption algorithm (algorithm) ... []

(15)

9 # Force re-key action (force) ... [no] 10 # Local auto-open wallet (local) ... [yes] 11 # SQL command (command) ... [] Standard keys: c - cont, b - back, s - stop, r - refr

c

BR0370I Directory /oracle/OL1/sapwallet/seprffjv created BR0202I Copying /oracle/OL1/112_64/dbs/ewallet.p12 BR0203I to /oracle/OL1/112_64/dbs/ewallet.cpy ... BR0202I Copying /oracle/OL1/112_64/dbs/ewallet.p12 BR0203I to /oracle/OL1/sapwallet/seprffjv/ewallet.sve ...

BR1716I Encryption wallet /oracle/OL1/112_64/dbs/ewallet.p12 saved successfully BR0280I BRSPACE time stamp: 2015-01-20 09:50:58

BR1008I End of BRSPACE processing: seprffjv.mde 2015-01-20 09:51:01 BR0280I BRSPACE time stamp: 2015-01-20 09:51:01

(16)

5 Execution

5.1 Stop and start the database

SQL> shutdown immediate; Database closed.

Database dismounted. ORACLE instance shut down. SQL> startup

ORA-32004: obsolete or deprecated parameter(s) specified for RDBMS instance ORACLE instance started.

Total System Global Area 1135820800 bytes Fixed Size 2252504 bytes Variable Size 570425640 bytes Database Buffers 553648128 bytes

Redo Buffers 9494528 bytes Database mounted.

Database opened.

5.2 Open database with Encryption Wallet

SQL> alter system set encryption wallet open identified by "test1234"; System altered.

5.3 Create one or more Encrypted Tablespaces

e.g.

If using BR*Tools, don't forget to specify "Tablespace encryption (encrypt) [yes]" OR

SQL> create tablespace <encrypted tablespace following SAPs recomendations, like PSAPSR3....> extent management local autoallocate segment space management auto encryption default storage (encrypt) datafile '<location of datafile>' size 20M;

(17)

testserver:oraol1 84> brtools BR0651I BRTOOLS 7.40 (8)

BR0280I BRTOOLS time stamp: 2015-01-20 10:04:40 BR0656I Choice menu 1 - please make a selection

--- BR*Tools main menu

1 = Instance management 2 - Space management 3 - Segment management 4 - Backup and database copy 5 - Restore and recovery 6 - Check and verification 7 - Database statistics 8 - Additional functions 9 - Exit program

Standard keys: c - cont, b - back, s - stop, r - refr

2

BR0280I BRTOOLS time stamp: 2015-01-20 10:04:44 BR0663I Your choice: '2'

--- Database space management

1 = Extend tablespace 2 - Create tablespace 3 - Drop tablespace 4 - Alter tablespace 5 - Alter data file 6 - Move data file

7 - Additional space functions 8 - Reset program status

(18)

BR0662I Enter your choice: 2

BR0280I BRTOOLS time stamp: 2015-01-20 10:04:46 BR0657I Input menu 82 - please enter/check input values --- BRSPACE options for create tablespace

1 - BRSPACE profile (profile) ... [initOL1.sap] 2 - Database user/password (user) .. [/] 3 ~ Tablespace name (tablespace) ... [] 4 - Confirmation mode (confirm) .... [yes] 5 - Scrolling line count (scroll) .. [20] 6 - Message language (language) .... [E]

7 - BRSPACE command line (command) . [-p initOL1.sap -s 20 -l E -f tscreate] Standard keys: c - cont, b - back, s - stop, r - refr

c

BR0280I BRTOOLS time stamp: 2015-01-20 10:04:54 BR0663I Your choice: 'c'

BR0291I BRSPACE will be started with options '-p initOL1.sap -s 20 -l E -f tscreate' BR0280I BRTOOLS time stamp: 2015-01-20 10:04:54

BR0280I BRTOOLS time stamp: 2015-01-20 10:04:58 BR0257I Your reply: 'c'

######################################################################### ######

BR1001I BRSPACE 7.40 (8)

BR1002I Start of BRSPACE processing: seprfgqk.tsc 2015-01-20 10:04:58 BR0484I BRSPACE log file: /oracle/OL1/sapreorg/seprfgqk.tsc

(19)

BR1010I BRSPACE action ID: seprfgqk BR1011I BRSPACE function ID: tsc BR1012I BRSPACE function: tscreate

BR0280I BRSPACE time stamp: 2015-01-20 10:05:00 BR0656I Choice menu 304 - please make a selection

--- Tablespace creation main menu

1 = Create tablespace 2 - Show tablespaces 3 - Show data files 4 - Show disk volumes 5 * Exit program

6 - Reset program status

c

BR0259I Program execution will be continued... BR0280I BRSPACE time stamp: 2015-01-20 10:05:03 BR0657I Input menu 305 - please enter/check input values --- Main options for creation of tablespace in database OL1 1 ? Tablespace name (tablespace) ... []

2 - Tablespace contents (contents) ... [data] 3 - Segment space management (space) ... [auto] 4 - Database owner of tablespace (owner) . [SAPSR3] 5 ~ Table data class / tabart (class) .... []

6 - Data type in tablespace (data) ... [both] 7 # Joined index/table tablespace (join) . []

(20)

8 ~ Uniform size in MB (uniform) ... [] 9 - Bigfile tablespace (bigfile) ... [no]

10 - Tablespace compression (compress) .... [no] 11 - Tablespace encryption (encryption) ... [no] 12 # Encryption algorithm (algorithm) ... [] Standard keys: c - cont, b - back, s - stop, r - refr

1

BR0681I Enter string value for "tablespace" []: PSAPSR3TESTEC

BR0280I BRSPACE time stamp: 2015-01-20 10:05:28 BR0683I New value for "tablespace": 'PSAPSR3TESTEC' BR0280I BRSPACE time stamp: 2015-01-20 10:05:28 BR0657I Input menu 305 - please enter/check input values --- Main options for creation of tablespace in database OL1 1 - Tablespace name (tablespace) ... [PSAPSR3TESTEC] 2 - Tablespace contents (contents) ... [data]

3 - Segment space management (space) ... [auto] 4 - Database owner of tablespace (owner) . [SAPSR3] 5 ~ Table data class / tabart (class) .... []

6 - Data type in tablespace (data) ... [both] 7 # Joined index/table tablespace (join) . [] 8 ~ Uniform size in MB (uniform) ... [] 9 - Bigfile tablespace (bigfile) ... [no]

10 - Tablespace compression (compress) .... [no] 11 - Tablespace encryption (encryption) ... [no] 12 # Encryption algorithm (algorithm) ... [] Standard keys: c - cont, b - back, s - stop, r - refr

11

(21)

BR0681I Enter string value for "encryption" (yes|no) [no]: yes

BR0280I BRSPACE time stamp: 2015-01-20 10:05:50 BR0683I New value for "encryption": 'yes'

BR0280I BRSPACE time stamp: 2015-01-20 10:05:50 BR0657I Input menu 305 - please enter/check input values --- Main options for creation of tablespace in database OL1 1 - Tablespace name (tablespace) ... [PSAPSR3TESTEC] 2 - Tablespace contents (contents) ... [data]

3 - Segment space management (space) ... [auto] 4 - Database owner of tablespace (owner) . [SAPSR3] 5 ~ Table data class / tabart (class) .... []

6 - Data type in tablespace (data) ... [both] 7 # Joined index/table tablespace (join) . [] 8 ~ Uniform size in MB (uniform) ... [] 9 - Bigfile tablespace (bigfile) ... [no]

10 - Tablespace compression (compress) .... [no] 11 - Tablespace encryption (encryption) ... [yes] 12 ~ Encryption algorithm (algorithm) ... [] Standard keys: c - cont, b - back, s - stop, r - refr

c

BR0259I Program execution will be continued... BR0280I BRSPACE time stamp: 2015-01-20 10:05:56 BR0657I Input menu 306 - please enter/check input values --- Space options for creation of tablespace PSAPSR3TESTEC (1. file)

1 - Tablespace file name (file) ... [/oracle/OL1/sapdata4/sr3testec_1/sr3testec.data1] 2 ~ Raw disk / link target (rawlink) ... []

3 - File size in MB (size) ... [40]

4 - File autoextend mode (autoextend) .... [yes] 5 - Maximum file size in MB (maxsize) .... [10000]

(22)

6 - File increment size in MB (incrsize) . [20]

7 - SQL command (command) ... [create tablespace PSAPSR3TESTEC extent management local autoallocate segment space management auto encryption default storage (encrypt) datafile

'/oracle/OL1/sapdata4/sr3testec_1/sr3testec.data1' size 40M autoextend on next 20M maxsize 10000M] Standard keys: c - cont, b - back, s - stop, r - refr

c

BR1059W Not enough free space in /oracle/OL1/sapdata4 for maximum size of file /oracle/OL1/sapdata4/sr3testec_1/sr3testec.data1, missing at least 2344.401 MB

BR1049W Not enough free space in /oracle/OL1/sapdata4 for total maximum size of all database files of tablespace PSAPSR3 located on this disk volume, missing at least 23544.401 MB

BR0668I Warnings or errors occurred - you can continue to ignore them or go back to repeat the last action BR0670I Enter 'c[ont]' to continue, 'b[ack]' to go back, 's[top]' to abort:

c

BR0259I Program execution will be continued... BR1091I Next data file can be specified now

BR0675I This is a optional action - do you want to execute it now?

BR0676I Enter 'y[es]' to execute the action, 'n[o]/c[ont]' to skip it, 's[top]' to abort: n

BR0280I BRSPACE time stamp: 2015-01-20 10:06:51 BR0257I Your reply: 'n'

BR0678I The action will be skipped...

BR0370I Directory /oracle/OL1/sapreorg/seprfgqk created BR0280I BRSPACE time stamp: 2015-01-20 10:06:52

(23)

BR0370I Directory /oracle/OL1/sapdata4/sr3testec_1 created BR0280I BRSPACE time stamp: 2015-01-20 10:06:52

BR1089I Creating tablespace PSAPSR3TESTEC ... BR0280I BRSPACE time stamp: 2015-01-20 10:06:53

BR1016I SQL statement 'create tablespace PSAPSR3TESTEC extent management local autoallocate segment space management auto encryption default storage (encrypt) datafile

'/oracle/OL1/sapdata4/sr3testec_1/sr3testec.data1' size 40M autoextend on next 20M maxsize 10000M' executed successfully

BR1060I Tablespace PSAPSR3TESTEC created successfully with file: /oracle/OL1/sapdata4/sr3testec_1/sr3testec.data1 40M

BR1821I Table data class (tabart) handling will be executed now BR0280I BRSPACE time stamp: 2015-01-20 10:06:53

BR0675I This is a recommended action - do you want to execute it now?

BR0676I Enter 'y[es]/c[ont]' to execute the action, 'n[o]' to skip it, 's[top]' to abort: n

BR0280I BRSPACE time stamp: 2015-01-20 10:07:02 BR0257I Your reply: 'n'

BR0678I The action will be skipped...

BR0340I Switching to the next online redolog file for database instance OL1 ... BR0321I Switch to the next online redolog file for database instance OL1 successful BR0280I BRSPACE time stamp: 2015-01-20 10:07:04

BR0319I Control file copy created: /oracle/OL1/sapreorg/seprfgqk/cntrlOL1.new 20267008 BR0280I BRSPACE time stamp: 2015-01-20 10:07:04

BR0256I Enter 'c[ont]' to continue, 's[top]' to cancel BRSPACE: c

BR0259I Program execution will be continued... BR0280I BRSPACE time stamp: 2015-01-20 10:07:13 BR0656I Choice menu 304 - please make a selection

(24)

Tablespace creation main menu 1 + Create tablespace

2 - Show tablespaces 3 - Show data files 4 - Show disk volumes 5 = Exit program

6 - Reset program status

5

BR0680I Do you really want to exit BRSPACE? Enter y[es]/n[o]: y

BR0280I BRSPACE time stamp: 2015-01-20 10:07:18 BR0257I Your reply: 'y'

BR0280I BRSPACE time stamp: 2015-01-20 10:07:18 BR1020I Number of tablespaces processed: 1 BR1003I BRSPACE function 'tscreate' completed

BR1008I End of BRSPACE processing: seprfgqk.tsc 2015-01-20 10:07:18 BR0280I BRSPACE time stamp: 2015-01-20 10:07:18

BR1006I BRSPACE completed successfully with warnings

######################################################################### ######

BR0292I Execution of BRSPACE finished with return code 1 BR0280I BRTOOLS time stamp: 2015-01-20 10:07:18

BR0668I Warnings or errors occurred - you can continue to ignore them or go back to repeat the last action BR0670I Enter 'c[ont]' to continue, 'b[ack]' to go back, 's[top]' to abort:

c

BR0280I BRTOOLS time stamp: 2015-01-20 10:07:36 BR0257I Your reply: 'c'

(25)

--- Database space management

1 = Extend tablespace 2 + Create tablespace 3 - Drop tablespace 4 - Alter tablespace 5 - Alter data file 6 - Move data file

7 - Additional space functions 8 - Reset program status

b

BR0280I BRTOOLS time stamp: 2015-01-20 10:07:45 BR0663I Your choice: 'b'

BR0673I Going back to the previous menu...

--- BR*Tools main menu

1 = Instance management 2 + Space management 3 - Segment management 4 - Backup and database copy 5 - Restore and recovery 6 - Check and verification 7 - Database statistics 8 - Additional functions 9 - Exit program

(26)

9

BR0280I BRTOOLS time stamp: 2015-01-20 10:07:47

BR0680I Do you really want to exit BRTOOLS? Enter y[es]/n[o]: y

BR0280I BRTOOLS time stamp: 2015-01-20 10:07:48 BR0257I Your reply: 'y'

BR0280I BRTOOLS time stamp: 2015-01-20 10:07:48 BR0653I BRTOOLS completed successfully with warnings

5.4 Transfer tables and indexes to the new tablespace with

**BR*Tools**

brspace -u / -f tbreorg -s <reorg_tsp> -t "*" -n <new_tsp> [-p <par_degree>]

5.5 Check if there are no more objects,segments,extents in

old unencrypted tablespace

(27)

(28)

www.sap.com/contactsap

© 2015 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company.

The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Please see

Oracle TDE Tablespace Encryption

Best Practice

Document Version: 1.0 – 2015-02-04

CUSTOMER

Oracle TDE Tablespace Encryption

Document History

Table of Contents

1

General Information

Caution

Note

2

SAP Note reference

3

Prerequisites

4 Preparations

4.1 Create a backup of sqlnet.ora (also in $ORACLE_HOME)

4.2 Supplement ENCRYPTION_WALLET_LOCATION in

sqlnet.ora

4.3 Check whether the path in

ENCRYPTION_WALLET_LOCATION exists and the Oracle

user also has write authorization for it.

4.4 Restart Database

4.5 Check if Wallet Directory was recognized by the database

(below statement should show DIRECTORY in column

WRL_PARAMETER)

4.6 Create Encryption Wallet

4.7 Check Encryption Wallet again (now, result should show

you 'OPEN', if not check steps before and the syntax in

sqlnet.ora)

4.8 Save Encryption Wallet

5

Execution

5.1

Stop and start the database

5.2 Open database with Encryption Wallet

5.3 Create one or more Encrypted Tablespaces

5.4 Transfer tables and indexes to the new tablespace with

BR*Tools

5.5 Check if there are no more objects,segments,extents in

old unencrypted tablespace

www.sap.com/contactsap

**BR*Tools**