Oracle Wallet（加密外部口令文件）
简介
本文讨论Oracle的Secure External Password Store特性，也成为SEPS或wallet。此特性可以是客户端程序将口令存于wallet，而不是以明码形式写到文件中。
本文实验完全参照文章：Get rid of clear passwords from your shell scripts with Oracle Secure External Password Store，此文非常有参考价值，完整，原理清晰，包括重要的注意事项。更多文章可访问：https://www.mydbaworld.com/category/oracle/
wallet的文件每一条记录包括服务名，用户名和口令。
wallet是客户端使用。
实验部分
我们测试的用户为sf_demo，口令为oracle：
$ sqlplus sf_demo/oracle@orclpdb1
$ mkdir -p /home/oracle/tnsadmin/wallet
$ cd /home/oracle/tnsadmin/
$ cat <<-EOF > sqlnet.ora
> SQLNET.WALLET_OVERRIDE = TRUE
> WALLET_LOCATION=(
> SOURCE=(METHOD=FILE)
> (METHOD_DATA=(DIRECTORY=/home/oracle/tnsadmin/wallet))
> )
> EOF
$ cat <<-EOF > tnsnames.ora
> ORCLPDB1 =
> (DESCRIPTION =
> (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
> (CONNECT_DATA =
> (SERVER = DEDICATED)
> (SERVICE_NAME = ORCLPDB1)
> )
> )
> EOF
创建wallet:
$ cd /home/oracle/tnsadmin/wallet
# 输入的口令是保护wallet的口令
$ mkstore -wrl /home/oracle/tnsadmin/wallet -create
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter password: *Wallet_Password*
Enter password again: *Wallet_Password*
$ ls -lrt
total 8
-rw-------. 1 oracle oinstall 0 Dec 21 20:57 ewallet.p12.lck
-rw-------. 1 oracle oinstall 0 Dec 21 20:57 cwallet.sso.lck
-rw-------. 1 oracle oinstall 536 Dec 21 21:05 ewallet.p12
-rw-------. 1 oracle oinstall 581 Dec 21 21:05 cwallet.sso
为wallet添加条目：
$ mkstore -wrl /home/oracle/tnsadmin/wallet -createCredential ORCLPDB1 sf_demo oracle
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password: *Wallet_Password*
测试，无需口令即可登录，但操作系统口令需保护好：
$ export TNS_ADMIN=/home/oracle/tnsadmin
$ sqlplus /@ORCLPDB1
SQL*Plus: Release 19.0.0.0.0 - Production on Sat Dec 21 21:01:01 2019
Version 19.3.0.0.0
Copyright (c) 1982, 2019, Oracle. All rights reserved.
Last Successful login time: Sat Dec 21 2019 20:47:31 +08:00
Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
SQL> show user
USER is "SF_DEMO"
查看wallet中的条目：
$ mkstore -wrl /home/oracle/tnsadmin/wallet -listCredential
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password: *Wallet_Password*
List credential (index: connect_string username)
1: ORCLPDB1 sf_demo
修改wallet中某条目的口令：
$ mkstore -wrl /home/oracle/tnsadmin/wallet -modifyCredential ORCLPDB1 sf_demo oracle
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password: *Wallet_Password*
实际上，我们可以看到口令的明码：
$ mkstore -wrl /home/oracle/tnsadmin/wallet -list
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password: *Wallet_Password*
Oracle Secret Store entries:
oracle.security.client.connect_string1
oracle.security.client.password1
oracle.security.client.username1
$ mkstore -wrl /home/oracle/tnsadmin/wallet -viewEntry oracle.security.client.password1
Oracle Secret Store Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password: *Wallet_Password*
oracle.security.client.password1 = oracle
删除某条目：
$ mkstore -wrl /home/oracle/tnsadmin/wallet -deleteCredential ORCLPDB1
如果不想别人使用你的wallet，唯一的途径是通过设置文件权限。
如果不想别人拷贝你的wallet到其它主机使用，可执行以下命令：
$ orapki wallet create -wallet /home/oracle/tnsadmin/wallet -auto_login_local
Oracle PKI Tool Release 19.0.0.0.0 - Production
Version 19.3.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.
Enter wallet password:
Operation is successfully completed.
当然，如果另一个主机的主机名与当前主机一样，也还是可以使用。