将数据库配置为使用内含服务器密钥的 TCPS
请在 Oracle 数据库服务器上执行以下步骤，以将网络配置为使用 Oracle Network Manager 激活 SSL。
配置 listener.ora 文件：
1. 启动 Net Manager 工具。如果 ORACLE_HOME 设置为环境变量，则 netmgr 命令可用。在命令提示符或终端中，输入以下命令以打开 Oracle Network Manager。
> netmgr
2. 导航至 > > 。
3. 单击 Add Address，然后选择 TCP/IP with SSL，并输入协议、主机名和端口的值，如下所示：
Protocol: TCP/IP with SSL
Host Name: vv-stepde-vm
Port: 2484
Host Name: vv-stepde-vm
Port: 2484
 |
Windchill 支持在 Oracle 数据库服务器上配置的专用 TCPS 端口 2484 进行 JDBCs 通信。Cognos 和 Solr 将不支持 JDBCs。将在现有的默认 TCP 端口 1521 (此为默认 Windchill 安装) 上管理所有 JDBC 通信。关于 listener.ora 配置的下一步显示了 Oracle 如何才能在两个不同的端口上同时提供 JDBC 和 JDBCs 服务。
|
4. 单击 > 。
下面是您创建的 listener.ora 文件示例。
...
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC2)))
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = vv-stepde-vm
)(PORT = 1521)))
(DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484)))
)
...
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC2)))
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = vv-stepde-vm
)(PORT = 1521)))
(DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484)))
)
...
◦ 如果需要客户端身份验证，请确保 listener.ora 文件中的 SSL_CLIENT_AUTHENTICATION 特性已设置为 TRUE：
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\wallets\server_wallet)))
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = PROTOCOL = IPC) (KEY = EXTPROC1)))
(DESCRIPTION =
(ADDRESS = PROTOCOL = TCP) (HOST = vv-stepde-vm)(PORT = 1521)))
(DESCRIPTION =
(ADDRESS =(PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484))))
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\wallets\server_wallet)))
LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
(ADDRESS = PROTOCOL = IPC) (KEY = EXTPROC1)))
(DESCRIPTION =
(ADDRESS = PROTOCOL = TCP) (HOST = vv-stepde-vm)(PORT = 1521)))
(DESCRIPTION =
(ADDRESS =(PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484))))
5. 配置 sqlnet.ora 文件。单击 Profile，并从下拉列表中选择 Oracle Advanced Security，如果没有 SSL 表单，然后在 SSL 选项卡上单击 Server。如果已有 SSL 表单，请确保 SSL 表单的钱包目录指向的是 server_wallet 目录。
下面是一个完整的 SSL 表单示例。
Configure Method: File System
Wallet Directory: C:\wallets\server_wallet
Configure SSL for: Server
Revocation Check: None
Require SSL Version: Any
Require Client Authentication: <Leave unchecked>
Wallet Directory: C:\wallets\server_wallet
Configure SSL for: Server
Revocation Check: None
Require SSL Version: Any
Require Client Authentication: <Leave unchecked>
◦ 如果需要客户端身份验证，请确保在 SSL 表单中选中 Require Client Authentication 复选框。保存此网络配置后，请验证 sqlnet.ora 文件中的身份验证参数是否已设置为 TRUE：
SSL_VERSION = 0
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\wallets\server_wallet)
)
)
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA =
(DIRECTORY = C:\wallets\server_wallet)
)
)
|
|
如果只需加密和服务器身份验证，则可以跳过此步骤。
|
6. 单击 > 。
7. 退出 Net Manager 工具。但是，请确保已保存更改并重新启动监听程序，以便获取新更改：
> lsnrctl stop
> lsnrctl start
> lsnrctl start
8. 启动 Net Manager 工具。
下面是在未进行客户端身份验证的情况下创建的 sqlnet.ora 和 listener.ora 文件示例。如果需要客户端身份验证，请确保 listener.ora 文件中的 SSL_CLIENT_AUTHENTICATION 特性已设置为 TRUE：
◦ sqlnet.ora
...
SQLNET.AUTHENTICATION_SERVICES=(TCPS,NTS)
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA = (DIRECTORY = C:\wallets\server_wallet))
)
SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_128_CBC_SHA,
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA)
...
SQLNET.AUTHENTICATION_SERVICES=(TCPS,NTS)
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA = (DIRECTORY = C:\wallets\server_wallet))
)
SSL_CIPHER_SUITES= (SSL_RSA_WITH_AES_128_CBC_SHA,
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA)
...
◦ listener.ora
...
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA = (DIRECTORY = C:\wallets\server_wallet))
)
...
SSL_CLIENT_AUTHENTICATION = FALSE
WALLET_LOCATION =
(SOURCE =
(METHOD = FILE)
(METHOD_DATA = (DIRECTORY = C:\wallets\server_wallet))
)
...
9. 配置 tnsnames.ora 文件。在 Net Manager 工具中，单击 Service Naming。
10. 要创建新服务，请单击 Edit，然后单击 Create。使用以下信息完成 Net Service Name Wizard：
Net Service Name: vv-stepde-vm_tcps
Select: TCP/IP with SSL (Secure Internet Protocal)
Host Name: vv-stepde-vm
Port Number: 2484
(Oracle8i or later) Service Name: orcl
Connection Type: Default database
Test the connection on page 5 of the wizard
Select: TCP/IP with SSL (Secure Internet Protocal)
Host Name: vv-stepde-vm
Port Number: 2484
(Oracle8i or later) Service Name: orcl
Connection Type: Default database
Test the connection on page 5 of the wizard
下面是您创建的 tnsnames.ora 文件示例：
...
vv-stepde-vm_tcps =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484)))
(CONNECT_DATA = (SERVICE_NAME = orcl))
)
...
vv-stepde-vm_tcps =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCPS)(HOST = vv-stepde-vm)(PORT = 2484)))
(CONNECT_DATA = (SERVICE_NAME = orcl))
)
...
11. 单击 > 。
12. 单击 > 。现在，配置即已完成。