RMAN加密备份的三种方式

来源：这里教程网时间：2026-03-03 17:30:37 作者：

前言：为了数据备份的安全性，在某些特定的情况下我们需要对备份进行加密操作。一般是加密厂商或者Oracle自带的加密方式进行加密。如果使用Oracle自带的加密方式，显然是增加了Oracle管理员的维护成本，如果使用厂商加密，一旦密钥丢失，那么恢复起来基本上就是不太可能的。但对于Oracle自带的加密，如果密钥丢失，还有一定的挽回方式。在我接触的数据库维护中，基本上很少使用加密备份的方式。

RMAN备份可以创建加密的备份集，加密方式分为三种模式

透明模式

口令模式

双体模式

透明模式和双体模式要求将主密钥存放钱包的安全文件中，钱包的路径由sqlnet.ora文件生命

一：开启钱包加密

##1.编辑sqlnet.ora文件，添加以下内容，并创建对应的目录

[oracle@orcl:/u01/app/oracle/product/12.2.0/db/network/admin]$ cat sqlnet.ora
ENCRYPTION_WALLET_LOCATION = (SOURCE =
                                  (METHOD = FILE)
                                  (METHOD_DATA =
                                  (DIRECTORY = /u01/app/oracle/product/12.2.0/db/lhh/wallet/)))
[oracle@orcl:/home/oracle]$ mkdir -p /u01/app/oracle/product/12.2.0/db/lhh/wallet
##2.创建钱包、设置其密码，打开钱包及在其内创建主密钥

sys@ORCL 09:28:29> ALTER SYSTEM SET ENCRYPTION KEY IDENTIFIED BY "qwe123!@#";System altered.

#设置完成之后生成一个ewallet.p12文件，我们设置的密码会存放到这个文件中
[oracle@orcl:/u01/app/oracle/product/12.2.0/db/lhh/wallet]$ ll
total 4
-rw------- 1 oracle oinstall 2848 Mar 19 09:28 ewallet.p12
##3.查看钱包是否已经打开

sys@ORCL 09:31:35> select * from V$ENCRYPTION_WALLET;WRL_TYPE   WRL_PARAMETER                                 STATUS     WALLET_TYPE          WALLET_OR FULLY_BAC     CON_ID
---------- --------------------------------------------- ---------- -------------------- --------- --------- ----------
FILE       /u01/app/oracle/product/12.2.0/db/lhh/wallet/ 

OPEN       PASSWORD             SINGLE    NO                 0

二：加密备份
##1.开启备份加密功能
RMAN> set encryption on;executing command: SET encryption
#指定算法加密

RMAN> set encryption on using 'AES256';executing command: SET encryption
#以下命令永久打开透明模式加密功能或设置加密算法

RMAN> configure encryption for database on;
RMAN> configure encryption algorithm 'AES256';
##2.测试透明加密备份


RMAN> set encryption on;executing command: SET encryption

RMAN> backup tablespace users;Starting backup at 19-MAR-22
using channel ORA_DISK_1
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00007 name=/oradata/orcl/users01.dbf
input datafile file number=00002 name=/oradata/orcl/users02.dbf
channel ORA_DISK_1: starting piece 1 at 19-MAR-22
channel ORA_DISK_1: finished piece 1 at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T094108_k3bf5n7v_.bkp tag=TAG20220319T094108 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:01
Finished backup at 19-MAR-22
Starting Control File and SPFILE Autobackup at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/autobackup/2022_03_19/o1_mf_s_1099734069_k3bf5ojb_.bkp comment=NONE
Finished Control File and SPFILE Autobackup at 19-MAR-22
#关闭钱包，尝试恢复

sys@ORCL 09:42:45> ALTER SYSTEM SET ENCRYPTION WALLET CLOSE IDENTIFIED BY "qwe123!@#";System altered.
还原过程提示钱包没有打开

RMAN> restore tablespace users;Starting restore at 19-MAR-22
using channel ORA_DISK_1
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00002 to /oradata/orcl/users02.dbf
channel ORA_DISK_1: restoring datafile 00007 to /oradata/orcl/users01.dbf
channel ORA_DISK_1: reading from backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T094108_k3bf5n7v_.bkp
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 03/19/2022 09:43:34
ORA-19870: error while restoring backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T094108_k3bf5n7v_.bkp
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open

三：不打开钱包的加密##1.直接设置加密密钥
#手工方式直接定义口令的加密备份方式，过程不需要打开钱包，值需要给出匹配的口令即可

RMAN> set encryption on IDENTIFIED BY "qwe123!@#" only;executing command: SET encryption
using target database control file instead of recovery catalog
##2.备份users表空间

RMAN> backup tablespace users;
Starting backup at 19-MAR-22
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=58 device type=DISK
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00007 name=/oradata/orcl/users01.dbf
input datafile file number=00002 name=/oradata/orcl/users02.dbf
channel ORA_DISK_1: starting piece 1 at 19-MAR-22
channel ORA_DISK_1: finished piece 1 at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T102532_k3bhrwpf_.bkp tag=TAG20220319T102532 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:01
Finished backup at 19-MAR-22
Starting Control File and SPFILE Autobackup at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/autobackup/2022_03_19/o1_mf_s_1099736733_k3bhrxx9_.bkp comment=NONE
Finished Control File and SPFILE Autobackup at 19-MAR-22
##不输入密钥进行还原操作提示ORA-19913
RMAN> restore tablespace users;
Starting restore at 19-MAR-22
using channel ORA_DISK_1
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00002 to /oradata/orcl/users02.dbf
channel ORA_DISK_1: restoring datafile 00007 to /oradata/orcl/users01.dbf
channel ORA_DISK_1: reading from backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T102532_k3bhrwpf_.bkp
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 03/19/2022 10:25:48
ORA-19870: error while restoring backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T102532_k3bhrwpf_.bkp
ORA-19913: unable to decrypt backup
ORA-28365: wallet is not open
#输入密码进行还原操作
RMAN> set decryption identified by "qwe123!@#";
RMAN> restore tablespace users;  
Starting restore at 19-MAR-22
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=42 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00002 to /oradata/orcl/users02.dbf
channel ORA_DISK_1: restoring datafile 00007 to /oradata/orcl/users01.dbf
channel ORA_DISK_1: reading from backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T102532_k3bhrwpf_.bkp
channel ORA_DISK_1: piece handle=/home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T102532_k3bhrwpf_.bkp tag=TAG20220319T102532
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 19-MAR-22

四：双体备份模式简而言之：就是钱包处于开启状态，并且进行备份的时候手工指定一个密钥，这样恢复的过程中，只要钱包打开或者输入口令解密两种方式选择其一，就可以进行还原
#1.开启钱包加密
idle 19-MAR-22> ALTER SYSTEM SET ENCRYPTION WALLET open IDENTIFIED BY "qwe123!@#";
#2.手工设置备份口令并备份users表空间
##这里注意，手工指定的口令和钱包口令是不一致的

RMAN> set encryption identified by "123456";executing command: SET encryption


RMAN> backup tablespace users;Starting backup at 19-MAR-22
using channel ORA_DISK_1
channel ORA_DISK_1: starting full datafile backup set
channel ORA_DISK_1: specifying datafile(s) in backup set
input datafile file number=00007 name=/oradata/orcl/users01.dbf
input datafile file number=00002 name=/oradata/orcl/users02.dbf
channel ORA_DISK_1: starting piece 1 at 19-MAR-22
channel ORA_DISK_1: finished piece 1 at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T105003_k3bk6vso_.bkp tag=TAG20220319T105003 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:01
Finished backup at 19-MAR-22
Starting Control File and SPFILE Autobackup at 19-MAR-22
piece handle=/home/oracle/fra/ORCL/autobackup/2022_03_19/o1_mf_s_1099738204_k3bk6x1p_.bkp comment=NONE
Finished Control File and SPFILE Autobackup at 19-MAR-22
#3.关闭钱包并讲数据库启动到mount状态

idle 19-MAR-22> ALTER SYSTEM SET ENCRYPTION WALLET close IDENTIFIED BY "qwe123!@#";
idle 19-MAR-22> startup mount forceORACLE instance started.
Total System Global Area 1493172224 bytes
Fixed Size                  8620896 bytes
Variable Size             788530336 bytes
Database Buffers          687865856 bytes
Redo Buffers                8155136 bytes
Database mounted.
#4.使用set decryption执行解密，并还原users表空间
##这里我们使用的是手工输入口令，输入的是我们动态生成的密钥

RMAN> set decryption identified by "123456";executing command: SET decryption

RMAN> restore tablespace users;Starting restore at 19-MAR-22
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=42 device type=DISK
channel ORA_DISK_1: starting datafile backup set restore
channel ORA_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_DISK_1: restoring datafile 00002 to /oradata/orcl/users02.dbf
channel ORA_DISK_1: restoring datafile 00007 to /oradata/orcl/users01.dbf
channel ORA_DISK_1: reading from backup piece /home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T105003_k3bk6vso_.bkp
channel ORA_DISK_1: piece handle=/home/oracle/fra/ORCL/backupset/2022_03_19/o1_mf_nnndf_TAG20220319T105003_k3bk6vso_.bkp tag=TAG20220319T105003
channel ORA_DISK_1: restored backup piece 1
channel ORA_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 19-MAR-22