DB / Oracle / 安装部署

Oracle 网络加密详解

2026.09.06

Oracle 网络加密详解

适用版本：Oracle Database 10g / 11g / 12c / 19c / 23ai 文档版本：v1.0 / 2026-07

1. 概述

Oracle 网络加密保护数据传输[1]：

方式：

  • Native Encryption
  • SSL/TLS
  • Kerberos
  • RADIUS

详细见：Oracle 网络架构与加密。

2. Native Encryption

2.1 sqlnet.ora

# 加密
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192, AES128, 3DES)
SQLNET.ENCRYPTION_TYPES_CLIENT = (AES256, AES192, AES128, 3DES)

# 完整性
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256, SHA1, MD5)
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA256, SHA1, MD5)

2.2 选项

- ACCEPTED：默认
- REJECTED：拒绝
- REQUESTED：请求
- REQUIRED：强制

2.3 验证

-- 视图
SELECT network_service_banner 
FROM v$session_connect_info 
WHERE sid = SYS_CONTEXT('USERENV', 'SID');

3. SSL/TLS

3.1 Wallet 创建

orapki wallet create -wallet /u01/wallet -pwd Wallet123
orapki wallet add -wallet /u01/wallet -pwd Wallet123 \
  -dn "CN=oradb1.example.com,O=example,C=US" \
  -keysize 2048 -self_signed -validity 365

orapki wallet display -wallet /u01/wallet -pwd Wallet123

3.2 启用自动登录

orapki wallet create -wallet /u01/wallet -pwd Wallet123 -auto_login

3.3 sqlnet.ora

WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY=/u01/wallet)))
SSL_CLIENT_AUTHENTICATION = FALSE
SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA256)
SSL_VERSION = 1.2

3.4 listener.ora

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCPS)(HOST = oradb1)(PORT = 1522))
    )
  )

SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY=/u01/wallet)))

3.5 tnsnames.ora

ORCL_SSL =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCPS)(HOST = oradb1)(PORT = 1522))
    (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = orcl))
    (SECURITY = (SSL_SERVER_CERT_DN = "CN=oradb1.example.com,O=example,C=US"))
  )

4. Kerberos

4.1 配置

# sqlnet.ora
SQLNET.AUTHENTICATION_SERVICES = (KERBEROS5)
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.KERBEROS5_CC_NAME = /tmp/krb5cc_500
SQLNET.KERBEROS5_MUTUAL_AUTHENTICATION = true

4.2 KDC

# /etc/krb5.conf
[libdefaults]
default_realm = EXAMPLE.COM
[realms]
EXAMPLE.COM = {
  kdc = kdc.example.com
  admin_server = kdc.example.com
}

4.3 连接

kinit oracle
sqlplus /@orcl

5. 配置示例

5.1 强制加密

# 服务端 sqlnet.ora
SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256)
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

5.2 客户端

# sqlnet.ora
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED

5.3 验证

-- v$session_connect_info
SELECT sid, network_service_banner 
FROM v$session_connect_info;

6. 密码安全

6.1 sqlnet.ora

# 密码版本
SQLNET.ALLOWED_LOGON_VERSION_SERVER = 12
SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 12

# 密码加密
SQLNET.PASSWORD_RULES = ...

6.2 密码文件

orapwd file=$ORACLE_HOME/dbs/orapworcl password=****** entries=10
orapwd file=$ORACLE_HOME/dbs/orapworcl password=****** format=12

7. IP 白名单

7.1 sqlnet.ora

TCP.INVITED_NODES = (192.168.1.10, 192.168.1.11, oradb1)
TCP.EXCLUDED_NODES = (192.168.1.100)
TCP.VALIDNODE_CHECKING = yes

8. 连接超时

SQLNET.INBOUND_CONNECT_TIMEOUT = 60
SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
SQLNET.RECV_TIMEOUT = 60
SQLNET.SEND_TIMEOUT = 60

9. 连接数控制

# sqlnet.ora
SQLNET.MAX_CONNECTIONS = 1024

# listener.ora
INBOUND_CONNECT_TIMEOUT_LISTENER = 60

10. 证书管理

10.1 创建 CA

# CA 私钥
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 365

# 签发证书
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

10.2 导入 Wallet

orapki wallet add -wallet /u01/wallet -pwd Wallet123 \
  -trusted_cert -cert /path/ca.crt

orapki wallet add -wallet /u01/wallet -pwd Wallet123 \
  -user_cert -cert /path/server.crt

11. 性能

11.1 Native

- AES-NI 硬件加速
- 性能影响 < 5%

11.2 SSL

- 握手开销
- 会话复用

12. 验证

12.1 连接

sqlplus -L system/pwd@orcl

12.2 网络抓包

tcpdump -i any port 1521 -A
# 加密后无法读取

12.3 视图

SELECT network_service_banner FROM v$session_connect_info;

13. 常见坑与排错

13.1 ORA-12660

- 加密协商失败
- 检查 sqlnet.ora

13.2 ORA-28857

- SSL 错误
- Wallet
- 证书

13.3 ORA-28862

- SSL 连接失败
- 端口 / 协议

13.4 ORA-12649

- 加密类型不匹配
- 协商

14. 最佳实践

  1. 强制加密：REQUIRED
  2. AES256：强加密
  3. SHA256：完整性
  4. SSL/TLS：现代
  5. 自动登录 Wallet：自动化
  6. IP 白名单：访问
  7. 超时：防护
  8. 证书有效期：监控
  9. 测试：验证
  10. 文档化：配置

15. 参考资料

[1] Oracle Database Security Guide 19c, “Configuring Network Encryption” https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/