.
\nIn Oracle Public Cloud, Transparent Data Encryption is not an option. You can use it because it is included in all database services for all editions. You have to use it because the database won’t allow you to create, or import, non encrypted tablespaces. This is controlled by a new parameter, encrypt_new_tablespaces, which defaults to CLOUD_ONLY;
\n<\/p>\n
In previous versions, we had to ENCRYPT explicitly the tablespace in the CREATE TABLESPACE statement.
\nHere we don’t need to add this clause in the DDL when we are on the Oracle Public Cloud because the default is:<\/p>\n
SQL> show parameter encrypt\n \nNAME TYPE VALUE\n------------------------------------ ----------- ------------------------------\nencrypt_new_tablespaces string CLOUD_ONLY<\/code><\/pre>\nThis parameter can take the following values:<\/p>\n
\nSQL> alter system set encrypt_new_tablespaces=tictactoe;\nalter system set encrypt_new_tablespaces=tictactoe\n*\nERROR at line 1:\nORA-00096: invalid value TICTACTOE for parameter encrypt_new_tablespaces, must be from among DDL, ALWAYS, CLOUD_ONLY\n<\/code><\/pre>\nThe CLOUD_ONLY will automatically encrypt new tablespaces when we are on the Oracle Public Cloud only.
\nThe ALWAYS will always encrypt new tablespaces, which is good if you have the Advanced Security Option and want to ensure that all data is encrypted
\nThe DDL will never encrypt new tablespaces, except when explicitely done from the CREATE TABLESPACE. This is similar to the behavior before this parameter was introduced.<\/p>\n
encrypt_new_tablespaces=DDL<\/h3>\n
If you are not on the Oracle Public Cloud, CLOUD_ONLY, the default, behaves as DDL. If you are on the Oracle Public Cloud, CLOUD_ONLY behaves like ALWAYS.<\/p>\n
You may think that you can bypass the obligation to encrypt, just by setting encrypt_new_tablespaces=DDL but it’s not a good idea. Let’s test it.<\/p>\n
I’ve set encrypt_new_tablespaces=ddl in an init.ora and I’ve created a database manually (CREATE DATABASE, catalog, catproc) and it works.<\/p>\n
In 12.2 you can encrypt SYSTEM, SYSAUX and UNDO but this is not mandatory. However, I have created a user tablespace, USERS without any problem thanks to encrypt_new_tablespaces=DDL:<\/p>\n
\nSQL> show parameter encrypt\n \nNAME TYPE VALUE\n------------------------------------ ----------- ------------------------------\nencrypt_new_tablespaces string ddl\n \nSQL> select TABLESPACE_NAME,ENCRYPTED from dba_tablespaces;\n \nTABLESPACE_NAME ENC\n------------------------------ ---\nSYSTEM NO\nSYSAUX NO\nSYS_UNDOTS NO\nUNDOTBS1 NO\nUSERS NO\n<\/code><\/pre>\nHere I’m able to work without any problem… except when I have to restart the instance.<\/p>\n
Startup<\/h3>\n\nSQL> startup\nORACLE instance started.\n \nTotal System Global Area 2214592512 bytes\nFixed Size 8622968 bytes\nVariable Size 1090522248 bytes\nDatabase Buffers 1107296256 bytes\nRedo Buffers 8151040 bytes\nDatabase mounted.\nORA-00603: ORACLE server session terminated by fatal error\nORA-01092: ORACLE instance terminated. Disconnection forced\nORA-28427: cannot create, import or restore unencrypted tablespace: USERS in Oracle Cloud\nProcess ID: 11378\nSession ID: 4 Serial number: 14394\n<\/code><\/pre>\nIt is impossible to open a database with unencrypted user tablespaces in the Oracle Public Cloud, whatever the encrypt_new_tablespaces is. I can only startup mount and there’s nothing to do at that point.<\/p>\n
Here is the alert.log related entries:<\/p>\n
\nDatabase Characterset is US7ASCII\nNo Resource Manager plan active\nVerifying all user tablespaces in pdb 0 are encrypted in Oracle Cloud..\nFound unencrypted tablespace USERS (pdb 0). Encrypted tablespace is mandatory in Oracle Cloud.\nErrors in file \/u01\/app\/oracle\/diag\/rdbms\/test\/TEST\/trace\/TEST_ora_11378.trc:\nORA-28427: cannot create, import or restore unencrypted tablespace: USERS in Oracle Cloud\nErrors in file \/u01\/app\/oracle\/diag\/rdbms\/test\/TEST\/trace\/TEST_ora_11378.trc:\nORA-28427: cannot create, import or restore unencrypted tablespace: USERS in Oracle Cloud\nError 28427 happened during db open, shutting down database\nErrors in file \/u01\/app\/oracle\/diag\/rdbms\/test\/TEST\/trace\/TEST_ora_11378.trc (incident=128065):\nORA-00603: ORACLE server session terminated by fatal error\nORA-01092: ORACLE instance terminated. Disconnection forced\nORA-28427: cannot create, import or restore unencrypted tablespace: USERS in Oracle Cloud\nIncident details in: \/u01\/app\/oracle\/diag\/rdbms\/test\/TEST\/incident\/incdir_128065\/TEST_ora_11378_i128065.trc\n2017-02-04 22:25:26.612000 +00:00\nopiodr aborting process unknown ospid (11378) as a result of ORA-603\nORA-603 : opitsk aborting process\nLicense high water mark = 1\nUSER (ospid: 11378): terminating the instance due to error 28427\n2017-02-04 22:25:27.615000 +00:00\nPSP0 (ospid: 11293): terminating the instance due to error 28427\nPMON (ospid: 11289): terminating the instance due to error 28427\n2017-02-04 22:25:28.621000 +00:00\nInstance terminated by PMON, pid = 11289\n<\/code><\/pre>\nYou don’t find those “Verifying all user tablespaces in pdb 0 are encrypted in Oracle Cloud..” when you are not in the Oracle Public Cloud.
\nBut in Oracle Public Cloud, the instance is forced to stop as soon as an un-encrypted tablespace is found.<\/p>\n
Fake it<\/h3>\n
What I’ll do now is only for academic purpose, to understand what happens and, maybe, troubleshoot if you have created unencrypted tablespaces. But it is not documented, and not supported.<\/p>\n
From a cloud instance, you can get metadata about your instance by getting attributes from http:\/\/192.0.0.192 (Oracle Cloud uses Nimbula)
\nWhen Oracle Database instance starts, it reads the dns domain from http:\/\/192.0.0.192\/latest\/attributes\/dns\/domain:<\/p>\n
\n[oracle@DBI122 ~]$ curl http:\/\/192.0.0.192\/latest\/attributes\/dns\/domain\ncompute-franck.oraclecloud.internal.[oracle@DBI122 ~]$\n<\/code><\/pre>\nI suppose that the detection of Oracle Cloud is done from that. If you are not in Oracle Cloud, you will have no answer from http:\/\/192.0.0.192 so let’s simulate that by blocking this ip address:<\/p>\n
\n[root@DBI122 opc]# iptables -A OUTPUT -d 192.0.0.192 -j REJECT\n \n[root@DBI122 opc]# iptables -L\nChain INPUT (policy ACCEPT)\ntarget prot opt source destination\n \nChain FORWARD (policy ACCEPT)\ntarget prot opt source destination\n \nChain OUTPUT (policy ACCEPT)\ntarget prot opt source destination\nREJECT all -- anywhere 192.0.0.192 reject-with icmp-port-unreachable\n<\/code><\/pre>\nNow back to my database, I can start it without any problem:<\/p>\n
\nSQL> startup\nORACLE instance started.\n \nTotal System Global Area 2214592512 bytes\nFixed Size 8622968 bytes\nVariable Size 1090522248 bytes\nDatabase Buffers 1107296256 bytes\nRedo Buffers 8151040 bytes\nDatabase mounted.\nDatabase opened.\n \nSQL> select TABLESPACE_NAME,ENCRYPTED from dba_tablespaces;\n \nTABLESPACE_NAME ENC\n------------------------------ ---\nSYSTEM NO\nSYSAUX NO\nSYS_UNDOTS NO\nUNDOTBS1 NO\nIOPS NO\n<\/code><\/pre>\nIn the alert.log I have nothing about checking encrypted tablespaces:<\/p>\n
\nNo Resource Manager plan active\n2017-02-04 22:31:34.510000 +00:00\nreplication_dependency_tracking turned off (no async multimaster replication found)\nStarting background process AQPC\n<\/code><\/pre>\nSo what?<\/h3>\n
encrypt_new_tablespaces=DDL is not a way to avoid encryption in the Oracle Public Cloud, except temporarily for a test on a database that you create for that and never re-start once you have created user tablespaces. There are still some bugs and issues with TDE (when importing from non-TDE, when using local undo,…) so it is good to know that there can be a workaround. But remember this is not supported. If you need this, please contact My Oracle Support.<\/p>\n","protected":false},"excerpt":{"rendered":"
By Franck Pachot . In Oracle Public Cloud, Transparent Data Encryption is not an option. You can use it because it is included in all database services for all editions. You have to use it because the database won’t allow you to create, or import, non encrypted tablespaces. This is controlled by a new parameter, […]<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[955,229],"tags":[135,96,448],"type_dbi":[],"class_list":["post-9751","post","type-post","status-publish","format-standard","hentry","category-cloud","category-database-administration-monitoring","tag-cloud","tag-oracle","tag-tde"],"acf":[],"yoast_head":"\n
Oracle Public Cloud 12cR2: TDE is not an option - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Oracle Public Cloud 12cR2: TDE is not an option\" \/>\n<meta property=\"og:description\" content=\"By Franck Pachot . In Oracle Public Cloud, Transparent Data Encryption is not an option. You can use it because it is included in all database services for all editions. You have to use it because the database won’t allow you to create, or import, non encrypted tablespaces. This is controlled by a new parameter, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-02-05T17:52:36+00:00\" \/>\n<meta name=\"author\" content=\"Oracle Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oracle Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\"},\"author\":{\"name\":\"Oracle Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"headline\":\"Oracle Public Cloud 12cR2: TDE is not an option\",\"datePublished\":\"2017-02-05T17:52:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\"},\"wordCount\":624,\"commentCount\":0,\"keywords\":[\"Cloud\",\"Oracle\",\"TDE\"],\"articleSection\":[\"Cloud\",\"Database Administration & Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\",\"name\":\"Oracle Public Cloud 12cR2: TDE is not an option - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"datePublished\":\"2017-02-05T17:52:36+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Oracle Public Cloud 12cR2: TDE is not an option\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\",\"name\":\"Oracle Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"caption\":\"Oracle Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Oracle Public Cloud 12cR2: TDE is not an option - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/","og_locale":"en_US","og_type":"article","og_title":"Oracle Public Cloud 12cR2: TDE is not an option","og_description":"By Franck Pachot . In Oracle Public Cloud, Transparent Data Encryption is not an option. You can use it because it is included in all database services for all editions. You have to use it because the database won’t allow you to create, or import, non encrypted tablespaces. This is controlled by a new parameter, […]","og_url":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/","og_site_name":"dbi Blog","article_published_time":"2017-02-05T17:52:36+00:00","author":"Oracle Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oracle Team","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/"},"author":{"name":"Oracle Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"headline":"Oracle Public Cloud 12cR2: TDE is not an option","datePublished":"2017-02-05T17:52:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/"},"wordCount":624,"commentCount":0,"keywords":["Cloud","Oracle","TDE"],"articleSection":["Cloud","Database Administration & Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/","url":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/","name":"Oracle Public Cloud 12cR2: TDE is not an option - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2017-02-05T17:52:36+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-public-cloud-12cr2-tde-is-not-an-option\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Oracle Public Cloud 12cR2: TDE is not an option"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee","name":"Oracle Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","caption":"Oracle Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9751","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=9751"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9751\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=9751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=9751"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=9751"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=9751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}