Lift & Shift oder Wie kommt meine (pluggable) Datenbank in die Cloud. Kai Uwe Fischer

Lift & Shift oder Wie kommt meine (pluggable) Datenbank in die Cloud Kai Uwe Fischer 21.11.2017

Die Logicalis Group Über 1,5 Mrd. $ Umsatz Mehr als 4.200 Mitarbeiter weltweit Niederlassungen in Europa, Nordamerika, Lateinamerika, Asien, Pazifik und Afrika Annähernd 10.000 Kunden aus dem privaten und öffentlichen Bereich 2

Logicalis Group Deutschland Über Ca. Umsatz im Fiskaljahr Mitarbeiter in Deutschland Niederlassungen in Über Kunden aus dem privaten und öffentlichen Bereich 3

Inforsacom Logicalis & Oracle Qualified LMS Partner Seit über 20 Jahren Oracle Partner Umsatzstärkster Partner bei Oracle in Deutschland Oracle ist auch unser umsatzstärkster Technologie-Partner Oracle-Veranstaltungen und -Kampagnen Oracle Referenzen (z. B. Sirona, Pari, DAT, Fuchs Petrolub) Exadata-Testmaschine für Exadata und ZDLRA POCs, auch im Kunden-RZ möglich Zertifizierter Oracle Exadata und ZDLRA Installation & Configuration Partner Eigene Cloud-Credits für Oracle IAAS & PAAS POCs Oracle Cloud Managed Service Provider Programm Lizenzberatung durch unser zertifiziertes LMS Team 4

Inforsacom Logicalis Stand 3.OG #322 Weitere Vorträge von Inforsacom Logicalis: Andrew Lacy Nahezu Zero Downtime Patching Raum Kiew Dienstag 12:00 Uhr Christoph Reeg Exadata Installation, wie geht das? Raum Singapur Donnerstag 9:00 Uhr Stefan Seck Mit Resource Management zur erfolgreichen Konsolidierung Raum Singapur Donnerstag 13:00 Uhr Andrew Lacy Panel: Patching Raum Shanghai Donnerstag 14:00 Uhr Jessica Steger Pluggable Databases: ein Überblick Raum Neu-Delhi Donnerstag 16:00 Uhr 5

Was gibt es zu beachten? SSH Port 22 muss in der Firewall geöffnet sein. Architektur Cloud DB s ab Oracle 12: Single / Multitenant Transparent Data Encryption (TDE) Quelle: Red Stack Magazin April 2017 6

Oracle Database Cloud Service / Optionbundling All new tablespace datafiles are encrypted by default accross all versions!!!! 7

Wege in die Oracle Database Cloud DB Backup in die Cloud / Erzeugen einer Cloud DB aus dem Cloud Backup PDB Clone (Oracle Enterprise Manager / SQL Developer) PDB Hot Clone Data Guard / Standby DB in der Cloud Data Pump Export / Import Data Pump Full Transportable Data Pump Transportable Tablespaces RMAN Cross-Platform Transportable PDB / Tablespace Backup Sets 8

Oracle Backup Database Cloud Service

Oracle Database Backup Cloud Service (ODBCS) System Oracle Database Operation system RMAN compression RMAN encryption Supported Versions Enterprise Edition: 10g Release 2 (10.2.0.5) and later Standard Edition (SE, SE1, SE2): 10g Release 2 (10.2.0.5), 11g Release 1 (11.1.0.7), 11g Release 2 (11.2.0.3 and 11.2.0.4), and later Linux, Solaris x86-64, SPARC, Windows, AIX, HP-UX, zlinux BASIC HIGH, MEDIUM, LOW benötigt Advanced Compression Option Enterprise Edition: Password, Transparent Data Encryption (TDE), dual mode. Standard Edition: Password, TDE, dual mode. Requires a patch (Doc ID 1640149.1) Oracle Advanced Security Option (ASO) Lizenz ist für die Verwendung von ODCBS NICHT notwendig! 11

Oracle Database Backup Cloud Service Download des Oracle Database Cloud Backup Modules (opc_installer.zip) von Oracle Technology Network (OTN): http://www.oracle.com/technetwork/database/availability/o racle-cloud-backup-2162729.html Entpacken der Zip Datei. Inhalt: opc_install.jar & opc_readme.txt # cd /u01/app/oracle/install # unzip opc_installer.zip 12

Oracle Database Backup Cloud Service Starten der Installation: (JDK mindestens Version 1.7) # java -jar opc_install.jar -servicename Storage -identitydomain XXXXX -opcid 'EMAIL ADDRESS' -opcpass 'password' -walletdir $ORACLE_HOME/dbs/wallet -libdir $ORACLE_HOME/lib - host https://xxxxxx.storage.oraclecloud.com/v1/storage-xxxxxx Oracle Database Cloud Backup Module Install Tool, build 2016-10-07 Oracle Database Cloud Backup Module credentials are valid. Oracle Database Cloud Backup Module wallet created in directory /u01/app/oracle/product/db/12.1.0.2/dbs/wallet. Oracle Database Cloud Backup Module initialization file /u01/app/oracle/product/db/12.1.0.2/dbs/opcifl01l.ora created. Downloading Oracle Database Cloud Backup Module Software Library from file opc_linux64.zip. Downloaded 26528348 bytes in 196 seconds. Transfer rate was 135348 bytes/second. Download complete. 13

Oracle Database Backup Cloud Service Folgende Dateien werden vom Backup Modul erzeugt File Location Purpose libopc.so (Linux /UNIX) oraopc.dll (Windows) opcsid.ora cwallet.sso As specified for the libdir parameter when you run the backup module installer. As specified for the configfile parameter when you run the backup module installer. Default location on Linux and UNIX systems: ORACLE_HOME/dbs Default location on Windows systems: ORACLE_HOME\database As specified for the walletdir parameter when you run the backup module installer. Example location: ORACLE_HOME/dbs/opc_wallet Operating system-specific SBT library that enables cloud backups and restores. Configuration file that contains the Oracle Database Backup Cloud Service container URL and credential wallet location, where SID is the system identifier of the Oracle database being backed up to Oracle Database Backup Cloud Service. Oracle wallet file that securely stores Oracle Database Backup Cloud Service credentials. This file is used during Recovery Manager (RMAN) backup and restore operations and is stored in the Oracle Database Backup Cloud Service wallet directory 14

Oracle Database Cloud Backup Service RMAN Konfiguration am Beispiel Linux / Unix: RMAN> CONFIGURE CHANNEL DEVICE TYPE sbt PARMS='SBT_LIBRARY=libopc.so, SBT_PARMS=(OPC_PFILE=<ORACLE_HOME>/dbs/opcSID.ora)'; RMAN> CONFIGURE CONTROLFILE AUTOBACKUP FORMAT FOR DEVICE TYPE SBT_TAPE TO '%F'; RMAN> CONFIGURE CONTROLFILE AUTOBACKUP ON; RMAN> CONFIGURE DEVICE TYPE sbt PARALLELISM 8; RMAN> BACKUP DEVICE TYPE sbt DATABASE SECTION SIZE 1G; RMAN> CONFIGURE COMPRESSION ALGORITHM 'MEDIUM'; (Optional, benötigt AC) 15

Oracle Database Cloud Backup Service Backup Test: RMAN> backup device type sbt current controlfile; Starting backup at 08.11.2016:17:32:51 released channel: ORA_DISK_1 allocated channel: ORA_SBT_TAPE_1 channel ORA_SBT_TAPE_1: SID=420 device type=sbt_tape channel ORA_SBT_TAPE_1: Oracle Database Backup Service Library VER=3.16.9.21 channel ORA_SBT_TAPE_1: starting full datafile backup set channel ORA_SBT_TAPE_1: specifying datafile(s) in backup set including current control file in backup set channel ORA_SBT_TAPE_1: starting piece 1 at 08.11.2016:17:33:02 RMAN-00571: =========================================================== RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS =============== RMAN-00571: =========================================================== RMAN-03009: failure of backup command on ORA_SBT_TAPE_1 channel at 11/08/2016 17:33:17 ORA-27030: skgfwrt: sbtwrite2 returned error ORA-19511: non RMAN, but media manager or vendor specific failure, error text: KBHS-01602: backup piece 0drkdqid_1_1 is not encrypted 16

Oracle Database Cloud Backup Service RMAN unterstützt zwei Arten von Backup Verschlüsselung: - Transparent Data Encryption (TDE) - Password Encryption RMAN> set encryption on identified by "password" only; RMAN> backup device type sbt current controlfile; RMAN> backup device type sbt as compressed backupset database plus archivelog not backed up; RMAN> list backup; 17

Oracle Database Cloud Backup Service Restore Backup RMAN> set decryption identified by "password"; RMAN> restore datafile 6; Starting restore at 09.11.2016:14:53:26 allocated channel: ORA_DISK_1 channel ORA_DISK_1: SID=122 device type=disk allocated channel: ORA_SBT_TAPE_1 channel ORA_SBT_TAPE_1: SID=178 device type=sbt_tape channel ORA_SBT_TAPE_1: Oracle Database Backup Service Library VER=3.16.9.21 channel ORA_SBT_TAPE_1: starting datafile backup set restore channel ORA_SBT_TAPE_1: specifying datafile(s) to restore from backup set channel ORA_SBT_TAPE_1: restoring datafile 00006 to /u01/app/oracle/oradata/ifl01l/users01.dbf channel ORA_SBT_TAPE_1: reading from backup piece 0mrkfk7n_1_1 channel ORA_SBT_TAPE_1: piece handle=0mrkfk7n_1_1 tag=tag20161109t095711 channel ORA_SBT_TAPE_1: restored backup piece 1 channel ORA_SBT_TAPE_1: restore complete, elapsed time: 00:00:55 Finished restore at 09.11.2016:14:54:25 RMAN> recover datafile 6; RMAN> repair datafile 6; alternativ ab Oracle 12.2 18

Backing Up to Oracle Database Backup Cloud Service Using Transparent Data Encryption (TDE) To back up using TDE you need to have a TDE wallet (TDE keystore), which is different from the OPC wallet that stores Oracle Database Backup Cloud Service credentials. 1. Add the following line to the sqlnet.ora file: ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=FILE) (METHOD_DATA= (DIRECTORY=path_to_TDE_wallet))) 2. Start SQL*Plus as sys: sysplus / as sysdba 3. Create the TDE wallet in the location specified in sqlnet.ora: SQL> alter system set encryption key identified by "TDE-password"; 4. Whenever the database is restarted, open the TDE wallet with the following command: SQL> alter system set encryption wallet open identified by "TDE-password ; 5. To back up an Oracle database that uses TDE: RMAN> SET ENCRYPTION ON; RMAN> BACKUP DATABASE 19

Cloud DB aus Cloud Backup erzeugen 20 Lift & Shift oder wie kommt meine Datenbank in die Cloud

Backup Fehler nach Änderung des Cloud Passwortes # java -jar opc_install.jar -servicename Storage -identitydomain XXXXX -opcid 'EMAIL ADDRESS' -opcpass 'newpassword' -walletdir $ORACLE_HOME/dbs/wallet -libdir $ORACLE_HOME/lib -host https://xxxxxx.storage. oraclecloud.com/v1/storage-xxxxxx Oracle Support: This is a core security policy in OPC and no exceptions. Oracle Cloud requires users to change their passwords on a regular basis, you need to perform this task regularly. 21 Lift & Shift oder wie kommt meine Datenbank in die Cloud

Clone a pluggable database to Oracle Cloud via Oracle Enterprise Manager Cloud Control 13c / SQLDeveloper

Klonen einer PDB in die Oracle Cloud / OEM 23

Klonen einer PDB in die Oracle Cloud / OEM 24

Post clone PDB creation operation 25

Klonen einer PDB in die Oracle Cloud / OEM 26

Klonen einer PDB in die Oracle Cloud / OEM 27

Klonen einer PDB in die Oracle Cloud / SQLDeveloper 28

Klonen einer PDB in die Oracle Cloud / SQLDeveloper 29

PDB Hot Clone

PDB Hot Clone Quell DB Enable ARCHIVELOG MODE Enable LOCAL UNDO SQL> select property_value from database_properties where property_name='local_undo_ ENABLED'; SQL> startup mount; SQL> alter database open upgrade; SQL> alter database local undo on; SQL> shutdown immediate; SQL> startup Create COMMON USER SQL> create user c##ifl identified by welcome1 container=all; SQL> grant sysoper to c##ifl container=all; SQL> grant create session to c##ifl container=all; 31

PDB Hot Clone / Ziel DB Create Database Link SQL> create public database link cdb122_link connect to c##ifl identified by welcome1 using 'CDB122'; Clone Pluggable Database SQL> create pluggable database KUF2_CL2 from KUF2@cdb122_link; Open Pluggable Database SQL> alter pluggable database KUF2_CL2 open; 32

PDB Hot Clone & REFRESH / Ziel DB Create Database Link SQL> create public database link cdb122_link connect to c##ifl identified by welcome1 using 'CDB122'; Clone Pluggable Database SQL> create pluggable database KUF2_CL1 from KUF2@cdb122_link refresh mode manual; Refresh Database (muss aus der PDB erfolgen, nicht aus dem root Container) SQL> alter pluggable database refresh; 33

PDB Hot Clone & REFRESH The refresh mode can be altered after the refreshable PDB is created, as shown below. Alter the refresh interval. SQL> alter pluggable database KUF2_CL1 refresh mode every 60 minutes; Set an automatically refreshed PDB to manual mode. SQL> alter pluggable database KUF2_CL1 refresh mode manual; Make a refreshable PDB non-refreshable. SQL> alter pluggable database close immediate; SQL> alter pluggable database KUF2_CL1 refresh mode none; SQL> alter pluggable database open; 34

Nach PDB Clonen / Vorsicht Falle! SQL> create tablespace KUF datafile size 5M; ORA-28374: typed master key not found in wallet SQL> select * from v$encryption_wallet; STATUS WALLET_TYPE CON_ID OPEN AUTOLOGIN 1 (CDB) OPEN AUOTLOGIN 3 (PDB1) OPEN_NO_MASTER_KEY AUOTLOGIN 5 (KUF2_CL2) Ab Oracle 12.2: SQL> administer key management set keystore open force keystore identified by "xxx"; SQL> administer key management set key force keystore identified by "xxx" with backup; 35

Nach PDB Clonen / Vorsicht Falle! Vor Oracle 12.2 # cd /u01/app/oracle/admin/orcl/tde_wallet/ # mv cwallet.sso cwallet.sso_bkp restart the database in order to close the wallet, manually open the wallet SQL> administer key management set keystore open identified by "xxxxx" container=all; SQL> alter session set container=kuf2_cl2; SQL> administer key management set key identified by "xxxxx" with backup; Erzeugt ein neues Wallet (ewallet.p12), dass cwallet.sso kann nicht mehr verwendet werden SQL> administer key management create auto_login keystore from keystore '/u01/app/oracle/admin/orcl/tde_wallet/' identified by 'XXXX'; SQL> administer key management set keystore close identified by 'XXXX' container=all; Restart Database 36

Data Guard Primary On-Prem Standby Cloud

Oracle Cloud Using Oracle Database Cloud Service Data Guard Standby for Hybrid DR Single-instance database acting as the standby database in an Oracle Data Guard configuration. The primary database is on your own system. (Not available on Oracle Cloud Machine) (Not available on Oracle Cloud Infrastructure) 38

Oracle Cloud / Security Configuration 39

Oracle Cloud / Security Configuration Erzeugen einer Security IP List mit Ihrer öffentlichen IP Adresse 40

Oracle Cloud / Security Configuration Anlegen einer Security Application 41

Oracle Cloud / Security Configuration 42

Oracle Cloud / Security Configuration Oracle Net Encryption Configuration Oracle Net encryption must be enabled by setting the following in the sqlnet.ora on the primary (On Premises) and standby (On Cloud) database servers located in $ORACLE_HOME/network/admin. SQLNET.ENCRYPTION_SERVER = requested (for on-premises) SQLNET.ENCRYPTION_SERVER = required (for Cloud) SQLNET.ENCRYPTION_TYPES_SERVER = (RC4_256, AES256) (both) SQLNET.ENCRYPTION_CLIENT = requested (both) SQLNET.ENCRYPTION_TYPES_CLIENT = (RC4_256, AES256) (both) 43

Datenbankübersicht im Oracle Enterprise Manager 44

Data Guard Ansicht im Oracle Enterprise Manager 45

Fazit Ein Knopfdruck reicht noch nicht aus Viele Möglichkeiten eine Datenbank in die Oracle Cloud zu migrieren Thema Security spielt eine zentrale Rolle Ständige Verbesserung & Weiterentwicklung der Oracle Cloud What's New for Oracle Database Cloud Service https://docs.oracle.com/en/cloud/paas/database-dbaas- cloud/csdbn/index.html#csdbn-guid-b12a35e9-93b5-4118- 9F49-E91EC29DB033 46

Kontakt Kai Uwe Fischer Senior PreSales Consultant Oracle Inforsacom LOGICALIS GmbH T: +49 6102 7786-767 M: +49 151 5264 3513 Martin-Behaim-Strasse 19-21 63263 Neu-Isenburg www.logicalis.de 47

Vielen Dank!