oracle wallet practices and common actions

Wallet role

Starting Oracle 10g R2, by using Oracle Wallet reach of any user without a password to log database (non-operating system authentication), which is very useful in shell scripts to be used in user password database to operate, it may not be expose user passwords. Wallet settings such as authentication information in the Oracle client by mkstore command, and then through the "sqlplus / @ connect_string" way you can directly connect to the database.

This example is for sysrls users do not need to use a password to log system, mkstore used as follows:

$ $ORACLE_HOME/bin/mkstore

mkstore [-wrl wrl] [-create] [-createSSO] [-delete] [-deleteSSO] [-list] [-createEntry alias secret] [-viewEntry alias] [-modifyEntry alias secret] [-deleteEntry alias] [-help]

1) install Oracle Client

2) Create a wallet storage directory and modify .bash_profile
mkdir / Home / sysrls / wallet
vi .bash_profile
ORACLE_BASE=/opt/oraapp ORACLE_HOME=/opt/oraapp/client/12.1.0.2_x64_DBAocl030 TNS_ADMIN=$ORACLE_HOME/network/admin/ PATH=$ORACLE_HOME/bin:$PATH LD_LIBRARY_PATH=${ORACLE_HOME}/lib:${LD_LIBRARY_PATH} LANG="en_US.UTF-8" NLS_LANG="AMERICAN_AMERICA.AL32UTF8" ORA_NLS10=$ORACLE_HOME/nls/data export ORACLE_BASE LANG ORACLE_HOME PATH LD_LIBRARY_PATH NLS_LANG ORA_NLS10 TNS_ADMIN

3)生成wallet
$ $ORACLE_HOME/bin/mkstore -wrl /home/sysrls/wallet -create

Enter password: <Enter the wallet password>

Enter password again: <confirm wallet password>

[sysrls@cnl20059850 wallet]$ ll
total 8
-rw-------. 1 sysrls sysrls 581 Jul 18 11:01 cwallet.sso
-rw-rw-rw-. 1 sysrls sysrls 0 Jul 18 10:52 cwallet.sso.lck
-rw-------. 1 sysrls sysrls 536 Jul 18 11:01 ewallet.p12
-rw-rw-rw-. 1 sysrls sysrls 0 Jul 18 10:52 ewallet.p12.lck

4) modify network configuration
vi $ ORACLE_HOME / network / admin / tnsnames.ora

CRCDB =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = 133.9.207.35)(PORT = 2001))
)
(CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = CRCDB)
)
)

$ vi $ORACLE_HOME/network/admin/sqlnet.ora

WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/home/sysrls/wallet)))

SQLNET.WALLET_OVERRIDE=TRUE

5) to a specific database user generates the Credential
$ ORACLE_HOME / bin / mkstore -wrl / Home / u_test / Wallet -createCredential CRCDB Wallet test123

5) confirm the user authentication information has been added to Wallet

$ $ORACLE_HOME/bin/mkstore -wrl $ORACLE_HOME/network/admin/wallet -listCredential

6) How to Generate Your machine can only make wallet
Oracle Wallet is a container that stores authentication and signing credentials.

Trusted certificates are stored in the Oracle Wallet when the wallet is used for security credentials.

PeopleSoft enables you to create an Oracle Wallet in two ways:

ORAPKI command line - The ORAPKI tool is available with Oracle database, so this tool can be used only by those users have a license for Oracle database.

OpenSSL utility - Users who do not have a license for Oracle database can use this utility to create their own certificates.

After creating an Oracle Wallet, you must configure SSL for the Workstation Listener and Jolt Listener ports to ensure secure client and server communications.

7)维护
生成wallet
mkstore -wrl /home/sysrls/wallet/ -createCredential CRCDB wallet Frank
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
Create credential oracle.security.client.connect_string1

查看wallet中的认证信息
[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet -listCredential
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
List credential (index: connect_string username)
1: CRCDB wallet
[sysrls@cnl20059850 wallet]$

修改wallet中的认证信息
[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet/ -modifyCredential CRCDB wallet test2
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
Modify credential
Modify 1

Delete wallet authentication information in
mkstore -wrl / home / sysrls / wallet -deleteCredential CRCDB

查看wallet中的条目
[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet/ -list
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
Oracle Secret Store entries:
oracle.security.client.connect_string1
oracle.security.client.password1
oracle.security.client.username1

查看wallet中条目的值
[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.connect_string1
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
oracle.security.client.connect_string1 = CRCDB
[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.username1
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
oracle.security.client.username1 = wallet

[sysrls@cnl20059850 wallet]$ mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.password1
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
oracle.security.client.password1 = test2

Modify wallet password file
orapki wallet change_pwd -wallet / home / sysrls / wallet /

It comes with a small script form maintenance

#!/bin/bash

echo -e "Useful action\n"
echo -e "1)create wallet"
echo -e "2)create Credential"
echo -e "3)check the created Credential"
echo -e "4)modify the created Credential"
echo -e "5)delete the created Credential"
echo -e "6)list Credential item"
echo -e "7)list Credential Entry value "
echo -e "8)modify wallet password"
echo -e "9)exit"
read -p "choose your action:" num1
case $num1 in

    1)
    echo -e "Please enter wallet password:\n"
    read -s password
    printf "$password\n$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -create
    echo -e "wallet create success\n"
    ;;
    2)
    echo -e "Please enter wallet password:"
    read -s password
    read -p "Please enter database tnsname:" tnsname
    read -p "Please enter database user:" user
    echo -n "Please enter database user's password:" 
    read -s dbpass
    printf "$dbpass\n$dbpass\n$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -createCredential $tnsname $user 
    echo -e "Credential create success\n"
    ;;
    3)
    echo -e "Please enter wallet password:\n"
    read -s password
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -listCredential
    ;;
    4)
    echo -e "Please enter wallet password:"
    read -s password
    read -p "Please enter database tnsname:" tnsname
    read -p "Please enter database user:" user
    echo -n "Please enter database user's password:"
    read -s dbpass
    printf "$dbpass\n$dbpass\n$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -modifyCredential $tnsname $user
    echo -e "modify Credential success\n"
    ;;
    5)
    echo -e "Please enter wallet password:"
    read -s password
    read -p "Please enter database tnsname:" tnsname
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -deleteCredential $tnsname
    echo -e "delete Credential success\n"
    ;;
    6)
    echo -e "Please enter wallet password:"
    read -s password
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -list
    ;;
    7)
    echo -e "Please enter wallet password:"
    read -s password
    read -p "Please enter Entryname type:" type
    if [ "$type" == "connect" ];then
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.connect_string1
    fi
    if [ "$type" == "user" ];then
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.username1
    fi
    if [ "$type" == "password" ];then
    printf "$password\n" | /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/mkstore -wrl /home/sysrls/wallet/ -viewEntry oracle.security.client.password1
    fi
    ;;
    8)
    /opt/oraapp/client/12.1.0.2_x64_DBAocl030/bin/orapki wallet change_pwd -wallet /home/sysrls/wallet/
    ;;
    9)
    exit 0

esac

oracle wallet practices and common actions

Guess you like