Managing Repository Encryption

Managing the repository encryption key includes tasks such as rotating the master encryption key or changing the keystore password.

About Oracle Audit Vault Server Repository Encryption

Learn about repository encryption.

Encryption of the Oracle Audit Vault Server’s event repository is enabled on new installations of Oracle Database Security Central. This feature uses Oracle Database’s Transparent Data Encryption (TDE) to encrypt all audit event data stored in the Audit Vault Server, data stored in external SAN storage, and data stored in archive locations.

Rotating the Master Key for Repository Encryption

Rotating encryption keys adds a layer of security to your encrypted data.

You should rotate the master encryption key for the Audit Vault Server’s event repository on a regular basis, according to your organization’s guidelines. It is also a good practice to rotate the encryption key as needed. For example, when a person who had access to your master key leaves your organization.

Note: If you restore the Audit Vault Server from a backup, the restore operation restores the system to a point in time. Therefore, restoring the system may reinstate an older encryption key.

Log in to the Oracle Database Security Central console as a super administrator.
Select Settings.
In the left navigation menu, select Storage.
In the page that appears, select Repository Encryption.
In the Rotate Master Key section, in the Keystore Password field, enter the keystore password.

This password is originally set as a required post-installation step.
Select Re-key button.

Changing the Keystore Password

For better security, periodically change the keystore password.

The keystore password for repository encryption is originally set as a required post-installation step. It is the same as the Event Repository Encryption password. You only need this password for restore operations, not backup operations. Thereafter, you can change this password in the Oracle Database Security Central console.

Log in to the Oracle Database Security Central console as a super administrator.
Select the Settings.
In the left navigation menu, select Storage.
In the page that appears, select Repository Encryption.
Under Change Keystore Password section, enter the following:
- Old password
- New password
- Re-enter new password
Select Change Password button.

See Also: Backup and Restore of Audit Vault Server for more information on using the keystore password to restore the Audit Vault Server from backup files.

Backing Up TDE Wallets

You can back up TDE wallets to preserve information.

It is important to perform regular backups of Oracle Audit Vault Server, which include the TDE wallet. However, if you cannot back up Oracle Audit Vault Server, then you should, at a minimum, do regular backups of the TDE wallet at this location:

/usr/local/dbfw/etc/wallets/dbfwdb_wallet

Oracle Database Security Central does not provide the ability to back up wallets. You should securely back the wallet up in a remote location.

Data Encryption on Upgraded Instances

Learn about data encryption on upgraded instances in Oracle Audit Vault Server.

Phases of Data Encryption

This topic contains a detailed procedure that can be used to start data encryption process.

WARNING: Do not run data encryption processes on a newly installed Oracle Audit Vault Server or on a system that has been upgraded from fresh install of release Oracle Database 12.2.x. With versions of Oracle Database 12.2.0 and above, all of the new installations have encryption enabled automatically. Thus, all of the table spaces are encrypted by default.

The data encryption process happens in two phases:

Enabling Data Encryption:

This phase is automatic and data encryption is enabled while performing an Audit Vault Server upgrade. The upgrade process prompts for a keystore password on standalone and primary systems. Upon successful upgrade, data encryption is automatically enabled. The newly created table spaces thereafter are automatically encrypted. However, table spaces created before upgrade continue to be in clear text.
Encrypting existing clear text table spaces:

This phase is triggered by the user. To encrypt the existing clear text table spaces, the user must initiate the data encryption process. This process is triggered by running the /usr/local/dbfw/bin/avdf_data_encryption.sh script. The detailed steps for encrypting existing clear text table spaces triggered by the user are available in this topic.

Before you begin

The rate of encryption is approximately 20 to 50 seconds to encrypt 1 GiB of data, depending on the hardware profile of the system.
To begin the process of encrypting the table spaces, the user must run the /usr/local/dbfw/bin/avdf_data_encryption.sh script as root.
Ensure to take Oracle DBSecCentral backup prior to the encryption process.
The user must have root operating system user privileges to run this procedure. Ensure the proper privileges are obtained.
The encryption process script must be executed on standalone system or on the primary in a HA set up. Ensure that the standby system is also up and running before running the encryption script. The script may result in an error if the standby system is down. The script encrypts table spaces on both the primary and standby system.
Ensure that the database is up and running prior to executing the encryption process. To verify the status of the database, log in as root user and run the command /etc/init.d/dbfwdb status
The encryption process script stops all the jobs running in the background. Ensure there is no critical process running that may be impacted.
Note:

Data encryption is not completely enabled on HA system, until the primary is successfully upgraded. After a successful upgrade, all clear text table spaces are in one of the following states:
- online
- offline local (offline but the data file resides on the AVS)
- offline remote (offline but the data files reside on the remote archive location)
- online retrieved by user
- online retrieved by a trail

To start Data Encryption process:

Log in to the system as root user.
Run the following command to start encryption:

/usr/local/dbfw/bin/avdf_data_encryption.sh start

The following message is displayed on the screen:

**************************************************************

       * This script will encrypt all online tablespaces and create *

       * a background job to encrypt offline tablespaces.           *

       * Encrypting online tablespaces could potentially take long  *

       * time depending on the size of the online data collected.   *

       * Note that during this time                                 *

       * - There will be no access to Web UI console.             *

       * - Event collection will be shutdown.                     *

       * - AV agents will not be able to connect.                 *

       * - AVCLI will not be able to connect.                     *

       * *

       * NOTE: It is recommended to take backup before continuing. *

**************************************************************
Do you want to continue (Y/N):

Type Y to continue with encryption.

The following message is displayed:

************************************************************

       * Do not interrupt this script execution or reboot.        *

       * To stop the script execution use                         *

       * 'avdf_data_encryption stop' command.                     *

       * Check /root/avdf_data_encryption.log to track progress   *

************************************************************

Note: At this point, it is recommended to move the process to background by executing Ctrl+z followed by bg. Alternately to keep the session alive, the user can run the command ssh -o ServerAliveInterval 20

The following messages are displayed on the screen:

Successfully encrypted online table spaces.
System is ready for use.
Offline table space encryption can be managed on the AVS GUI.

Note: Contact My Oracle Support with the printed output in the event of a failure.

The following message is displayed in the /var/log/avdf_data_encryption.log file:
```
Encrypting <tbsp name> Tablespace : % done
```
Once the encryption process is successfully completed, another job to encrypt offline table spaces is created and enabled in the background. All the services appear online and the following message is displayed:

System is ready for use
In case the encryption process fails, the /var/log/avdf_data_encryption.log file displays the following error message.

Failed to encrypt table spaces: Please contact Oracle Support
Run the following command to stop encryption:

/usr/local/dbfw/bin/avdf_data_encryption.sh stop

Note: Ensure to run the stop command only after you see the following message in the /var/log/avdf_data_encryption.log:

You may issue stop command to gracefully stop the encrypting process

Note: Once the stop encryption command is executed, the encryption process exits only after encrypting the current table space that is being encrypted. It is always recommended to run the script again to complete the encryption process.
In case the user decides to perform a reboot of the system during the encryption process, it stops at the current table space that encryption last accessed. The user can decide to run the script again to complete the encryption process.
In case the dbfwdb service terminates unexpectedly, contact Oracle Support. The encryption script will not run if this service is down.
The encryption process collects all the logs to /var/log/avdf_data_encryption.log file securely.
After all online table spaces are encrypted, a background job ENCRYPT_OFFLINE_TBSP is enabled to perform encryption of offline table spaces. This job encrypts all table spaces for those data files that reside locally on the system. In case the data file is located on the remote location nfs/scp/smb, the data file is copied to the local system, encrypted, and setup for re archival. The user must manually perform the re archival process to ensure that the data file in the remote location scp/smb is encrypted. The user can navigate to Settings and Repository Encryption page to view a list of offline table spaces that are not encrypted. If the data file is not available, the message displayed indicates the same.

The process of encrypting offline table spaces can be in one of the following states.

Message	Description
`NOT YET STARTED`	The user has not executed the script to encrypt table spaces.
`COMPLETED`	All online and offline table spaces are encrypted. Any new table spaces created will also be encrypted. This is the final state.
`IN PROGRESS`	The background job is currently encrypting offline table spaces.
`USER`	The background job is waiting for user input. User must visit the Repository Encryption page and take appropriate action.
`ERROR`	There was an error in encrypting one or more table spaces. The user must download the diagnostics and provide that to Oracle Support.
`TRAIL`	The table space has been retrieved by a trail as it is collecting old data. Wait for the trail to release the table space.

In the ERROR state the background job is disabled and hence the user, after fixing the cause of the error must re-enable the job from the Repository Encryption page.
In the event of system reboot, power failure, switch over, or fail over the user can run the encryption process again.