{"id":5567,"date":"2021-06-24T08:37:32","date_gmt":"2021-06-24T08:37:32","guid":{"rendered":"https:\/\/swiv.com.br\/producing-password-based-encrypted-backups\/"},"modified":"2026-05-27T20:02:31","modified_gmt":"2026-05-27T19:02:31","slug":"producing-password-based-encrypted-backups","status":"publish","type":"post","link":"https:\/\/swiv.com.br\/index.php\/2021\/06\/24\/producing-password-based-encrypted-backups\/","title":{"rendered":"Producing Password-based Encrypted Backups"},"content":{"rendered":"\n<p>Realizar opera\u00e7\u00f5es de backup com criptografia pelo RMAN, protege os arquivos de potenciais acessos indevidos, aumentando assim a seguran\u00e7a das informa\u00e7\u00f5es que est\u00e3o no banco de dados. Este recurso est\u00e1 dispon\u00edvel apenas na Edi\u00e7\u00e3o Enterprise, exige um licenciamento a parte (Oracle Advanced Security) e precisa que o valor do par\u00eametro COMPATIBLE seja igual ou acima de 10.2.0. Neste artigo, vamos explorar um dos tr\u00eas poss\u00edveis m\u00e9todos de criptografia no RMAN, que seria o Password-based, onde no momento do backup, informamos uma senha para que a opera\u00e7\u00e3o seja realizada. Esse tipo de criptografia n\u00e3o exige que o TDE (Transparent Data Encryption) esteja habilitado, e \u00e9 ideal para os casos de backups pontuais, que devem ser enviados para um agente externo, por exemplo. Obviamente, caso n\u00e3o tenhamos essa senha guardada, n\u00e3o \u00e9 poss\u00edvel realizar o restore dos arquivos sem a mesma.<\/p>\n\n\n\n<p>No RMAN, podemos observar o algoritmo padr\u00e3o de criptografia, conforme abaixo:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \\&quot;wp-block-syntaxhighlighter-code\\&quot;\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@oel8 ~]$ rman target \/\n \nRecovery Manager: Release 18.0.0.0.0 - Production on Thu Jun 24 05:26:48 2021\nVersion 18.13.0.0.0\n \nCopyright (c) 1982, 2018, Oracle and\/or its affiliates.  All rights reserved.\n \nconnected to target database: RMANDB (DBID=3825250984)\n \nRMAN&gt; SHOW ENCRYPTION ALGORITHM;\n \nusing target database control file instead of recovery catalog\nRMAN configuration parameters for database with db_unique_name RMANDB are:\nCONFIGURE ENCRYPTION ALGORITHM &#039;AES128&#039;; # default\n<\/pre><\/div>\n\n\n<p>Caso precisemos alterar este algoritmo, podemos consultar os dispon\u00edveis na View abaixo:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \\&quot;wp-block-syntaxhighlighter-code\\&quot;\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&gt; SELECT ALGORITHM_NAME FROM V$RMAN_ENCRYPTION_ALGORITHMS;\n \nALGORITHM_NAME\n----------------------------------------------------------------\nAES128\nAES192\nAES256\n<\/pre><\/div>\n\n\n<p>Tirando isso, n\u00e3o temos par\u00e2metros persistentes do RMAN para realizar o backup com criptografia password-based. Devemos definir o seu uso em tempo de execu\u00e7\u00e3o, conforme exemplo abaixo:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \\&quot;wp-block-syntaxhighlighter-code\\&quot;\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nRMAN&gt; SET ENCRYPTION ON IDENTIFIED BY oracle ONLY;\n \nexecuting command: SET encryption\nusing target database control file instead of recovery catalog\n \nRMAN&gt; BACKUP TABLESPACE USERS TAG &#039;BSS&#039;;\n \nStarting backup at 2021-06-24:05:31:27\nallocated channel: ORA_DISK_1\nchannel ORA_DISK_1: SID=107 device type=DISK\nchannel ORA_DISK_1: starting full datafile backup set\nchannel ORA_DISK_1: specifying datafile(s) in backup set\ninput datafile file number=00007 name=\/oracle\/dados\/RMANDB\/datafile\/o1_mf_users_h8nyrkn7_.dbf\nchannel ORA_DISK_1: starting piece 1 at 2021-06-24:05:31:27\nchannel ORA_DISK_1: finished piece 1 at 2021-06-24:05:31:28\npiece handle=\/oracle\/fra\/RMANDB\/backupset\/2021_06_24\/o1_mf_nnndf_BSS_jf8jpzor_.bkp tag=BSS comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:00:01\nFinished backup at 2021-06-24:05:31:28\n \nStarting Control File and SPFILE Autobackup at 2021-06-24:05:31:28\npiece handle=\/oracle\/fra\/RMANDB\/autobackup\/2021_06_24\/o1_mf_s_1076045488_jf8jq1d7_.bkp comment=NONE\nFinished Control File and SPFILE Autobackup at 2021-06-24:05:31:31\n<\/pre><\/div>\n\n\n<p>No comando LIST, n\u00e3o \u00e9 poss\u00edvel distinguir se o backupset est\u00e1 criptografado ou n\u00e3o:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \\&quot;wp-block-syntaxhighlighter-code\\&quot;\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nRMAN&gt; LIST BACKUP TAG &#039;BSS&#039;;\n \n \nList of Backup Sets\n===================\n \n \nBS Key  Type LV Size       Device Type Elapsed Time Completion Time\n------- ---- -- ---------- ----------- ------------ -------------------\n337     Full    13.25M     DISK        00:00:01     2021-06-24:05:31:28\n        BP Key: 366   Status: AVAILABLE  Compressed: NO  Tag: BSS\n        Piece Name: \/oracle\/fra\/RMANDB\/backupset\/2021_06_24\/o1_mf_nnndf_BSS_jf8jpzor_.bkp\n  List of Datafiles in backup set 337\n  File LV Type Ckp SCN    Ckp Time            Abs Fuz SCN Sparse Name\n  ---- -- ---- ---------- ------------------- ----------- ------ ----\n  7       Full 2974262    2021-06-24:05:31:27              NO    \/oracle\/dados\/RMANDB\/datafile\/o1_mf_users_h8nyrkn7_.dbf\n<\/pre><\/div>\n\n\n<p>Com a consulta abaixo, percebemos que o mesmo foi criptografado:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \\&quot;wp-block-syntaxhighlighter-code\\&quot;\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nRMAN&gt; SELECT S.RECID AS &quot;BS_REC&quot;, P.RECID AS &quot;BP_REC&quot;, P.ENCRYPTED FROM V$BACKUP_PIECE P, V$BACKUP_SET S WHERE P.SET_STAMP = S.SET_STAMP AND P.SET_COUNT = S.SET_COUNT AND P.TAG =&#039;BSS&#039;;\n \n    BS_REC     BP_REC ENC\n---------- ---------- ---\n       337        366 YES\n<\/pre><\/div>\n\n\n<p>O backupset gerado s\u00f3 poder\u00e1 ser utilizado caso o analista possua a senha usada no momento do backup. Em outro artigo, exploraremos o seu uso em opera\u00e7\u00e3o de restore.<\/p>\n\n\n\n<p>Obs: Este procedimento foi criado pelo senhor Ahmed Baraka (www.ahmedbaraka.com) e foi apenas reproduzido por mim em um laborat\u00f3rio pessoal para fins de aprendizado.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Realizar opera\u00e7\u00f5es de backup com criptografia pelo RMAN, protege os arquivos de potenciais acessos indevidos, aumentando assim a seguran\u00e7a das informa\u00e7\u00f5es que est\u00e3o no banco de dados. Este recurso est\u00e1 dispon\u00edvel apenas na Edi\u00e7\u00e3o Enterprise, exige um licenciamento a parte (Oracle Advanced Security) e precisa que o valor do par\u00eametro COMPATIBLE seja igual ou acima [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5567","post","type-post","status-publish","format-standard","hentry","category-backup-recovery"],"_links":{"self":[{"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/posts\/5567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/comments?post=5567"}],"version-history":[{"count":1,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/posts\/5567\/revisions"}],"predecessor-version":[{"id":9095,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/posts\/5567\/revisions\/9095"}],"wp:attachment":[{"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/media?parent=5567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/categories?post=5567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swiv.com.br\/index.php\/wp-json\/wp\/v2\/tags?post=5567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}