oracle 加密连接
Database Advanced Security
（原创部分，只要在客户端两个项目都是required，服务器端不用管sqlnet.ora，就可以自动生效了，而且如果看效果的话，直接select * from v$session_connect_info试图里就有，11g比10g的字段多一些，“Oracle Advanced Security: DES encryption service adapter”只要有你设置的加密算法就行了，数据一致性校验同理而已。）
Oracle 高级安全分为两部分：
1.网络传输加密（包括ssl）
2.完整性校验
一．网络传输加密:
网络传输加密即将客户端也server段之间传输的数据进行加密：
Oracle提供了很多加密方法来实现这一功能，
完整性校验也同样依赖这些加密算法来实现
实施：
1.首先看一下，你当前的数据库是否安装了oralce 高级安全组件，oracle是否帮你安装了相应的加密算法。
1,1先看组件：
[oracle@vm10g logs]$ adapters
Installed Oracle Net transport protocols are:
IPC
BEQ
TCP/IP
SSL
RAW
SDP/IB
Installed Oracle Net naming methods are:
Local Naming (tnsnames.ora)
Oracle Directory Naming
Oracle Host Naming
Error!!! Oracle Names Server Naming is not completely installed!
Installed Oracle Advanced Security options are:
RC4 40-bit encryption
RC4 56-bit encryption
RC4 128-bit encryption
RC4 256-bit encryption
DES40 40-bit encryption
DES 56-bit encryption
3DES 112-bit encryption
3DES 168-bit encryption
AES 128-bit encryption
AES 192-bit encryption
AES 256-bit encryption
MD5 crypto-checksumming
SHA-1 crypto-checksumming
Kerberos v5 authentication
RADIUS authentication
Windows 下只能通过uninstall 时 有个组件列表里面能看见
2.网络传输安全加密的方式：
网络传输加密需要在客户端可服务端两面分别配置，如应用也要加密则需要改程序。
高级网络安全的配置文件就是本机的sqlnet.ora文件。
关于网络传输加密的配置条目大约有3行
SQLNET.ENCRYPTION_SERVER = [accepted | rejected | requested | required]
默认值：accepted
SQLNET.CRYPTO_SEED = 'qweqwe123123'
长度10-70字母和数字（9i中必填10g中可填可不填）
SQLNET.ENCRYPTION_TYPES_SERVER= (RC4_128)加密算法
默认值是all available algorithms
下面是设置对照表，off表示加密失效，on加密开启，conn fails 设置失败。
另外如果两端的配置文件中SQLNET.ENCRYPTION_TYPES_SERVER所选的加密算法 不一样也会连接失败。但是一段有加密算法一端没有也没事。
| Client Setting |
Server Setting |
Encryption and Data Negotiation |
| REJECTED |
REJECTED |
OFF |
| ACCEPTED |
REJECTED |
OFF |
| REQUESTED |
REJECTED |
OFF |
| REQUIRED |
REJECTED |
Connection fails |
| REJECTED |
ACCEPTED |
OFF |
| ACCEPTED |
ACCEPTED |
OFF 不配置的情况下默认就是这种 |
| REQUESTED |
ACCEPTED |
ON |
| REQUIRED |
ACCEPTED |
ON |
| REJECTED |
REQUESTED |
OFF |
| ACCEPTED |
REQUESTED |
ON |
| REQUESTED |
REQUESTED |
ON |
| REQUIRED |
REQUESTED |
ON |
| REJECTED |
REQUIRED |
Connection fails |
| ACCEPTED |
REQUIRED |
ON |
| REQUESTED |
REQUIRED |
ON |
| REQUIRED |
REQUIRED |
ON |
在netmgr的profile中的oracle advantage security中也可以设置。
但是在使用之前必须在
/u01/app/oracle/10.2.0/db_1/network/tools/NetProperties 中的
INSTALLEDCOMPONENTS=后面的参数改成下面这种才会显示高级安全选项来。
INSTALLEDCOMPONENTS=CLIENT,NET8,JAVAVM,SERVER,ANO
3.如可查看是否生效：
开启trace 一定记得用完关掉。
trace_level_server=16---#必填
trace_level_client=16---#client填
trace_directory_server=/home/oracle/server---#sever填
trace_directory_client=/home/oracle/clinet ----#client填
trace_file_client=cli ----#client填
trace_file_server=srv --#sever填
trace_unique_client=true ----#client填
客户端连接后就会在相应的目录下产生效应的trace在里面搜一下就能看到
-----------------------------------------生效
[10-JUL-2012 10:13:44:217] naeshow: entry
[10-JUL-2012 10:13:44:217] naeshow: These are the encryption algorithms that the client will accept:
[10-JUL-2012 10:13:44:217] naeshow: Choice 0: 'RC4_40' (ID 1)
[10-JUL-2012 10:13:44:249] na_tns: encryption is active, using RC4_40
srv.trc -------------------------------没生效
[10-JUL-2012 10:02:44:644] nam_gnsp: Reading parameter "SQLNET.ENCRYPTION_SERVER" from parameter file
[10-JUL-2012 10:02:44:645] nam_gnsp: Found value "accepted"
[10-JUL-2012 10:02:44:645] nam_gic: entry
[10-JUL-2012 10:02:44:645] nam_gic: Counting # of items in "SQLNET.ENCRYPTION_TYPES_SERVER" parameter
[10-JUL-2012 10:02:44:645] nam_gic: Parameter not found
[10-JUL-2012 10:02:44:645] nam_gic: exit
[10-JUL-2012 10:02:44:645] naesno: Using default value "all available algorithms"
[10-JUL-2012 10:02:44:645] naeshow: entry
[10-JUL-2012 10:02:44:645] naeshow: These are the encryption algorithms that the server will accept, in decreasing order of preference:
[10-JUL-2012 10:02:44:645] naeshow: Choice 0: no algorithm; encryption inactive