## 1. 数据库安全
– 使用专用的GoldenGate用户
– 最小化用户权限
– 启用审计
– 定期更改密码

## 2. 系统安全
– 限制GoldenGate目录的访问权限
– 定期检查系统日志
– 启用防火墙
– 定期更新系统补丁

## 3. 网络安全
– 使用加密传输
– 限制网络访问范围
– 监控网络流量
– 配置网络防火墙

## 4. 配置安全
– 保护配置文件
– 加密敏感信息
– 定期备份配置
– 限制配置文件的访问权限

## 5. 监控与审计
– 监控GoldenGate进程
– 审计用户操作
– 定期检查安全日志
– 及时处理安全事件

from GoldenGate视频:www.itpux.com

Part03-生产环境项目实施方案

3.1 数据库权限配置

数据库权限配置是GoldenGate安全管理的重要组成部分。以下是具体的实施方案：

## 1. 创建GoldenGate用户

### 1.1 源端数据库
SQL> CREATE USER fgedu IDENTIFIED BY fgedu123;
SQL> GRANT CREATE SESSION, ALTER SESSION TO fgedu;
SQL> GRANT SELECT ANY DICTIONARY, SELECT ANY TABLE TO fgedu;
SQL> GRANT FLASHBACK ANY TABLE TO fgedu;
SQL> GRANT EXECUTE ON DBMS_FLASHBACK TO fgedu;
SQL> GRANT EXECUTE ON DBMS_LOGMNR TO fgedu;
SQL> GRANT SELECT ON V_$DATABASE TO fgedu;
SQL> GRANT SELECT ON V_$LOG TO fgedu;
SQL> GRANT SELECT ON V_$LOG_HISTORY TO fgedu;
SQL> GRANT SELECT ON V_$LOGMNR_CONTENTS TO fgedu;
SQL> GRANT SELECT ON V_$LOGMNR_PARAMETERS TO fgedu;
SQL> GRANT SELECT ON V_$LOGFILE TO fgedu;
SQL> GRANT SELECT ON V_$ARCHIVED_LOG TO fgedu;
SQL> GRANT SELECT ON V_$TRANSACTION TO fgedu;
SQL> GRANT SELECT ON V_$SESSION TO fgedu;
SQL> GRANT SELECT ON V_$MYSTAT TO fgedu;
SQL> GRANT SELECT ON V_$STATNAME TO fgedu;

### 1.2 目标端数据库
SQL> CREATE USER fgedu IDENTIFIED BY fgedu123;
SQL> GRANT CREATE SESSION, ALTER SESSION TO fgedu;
SQL> GRANT CREATE TABLE, CREATE INDEX, CREATE VIEW TO fgedu;
SQL> GRANT INSERT, UPDATE, DELETE, SELECT ON fgedu.* TO fgedu;
SQL> GRANT EXECUTE ON DBMS_FLASHBACK TO fgedu;

## 2. 配置数据库审计

### 2.1 启用审计
SQL> ALTER SYSTEM SET audit_trail=DB,EXTENDED SCOPE=SPFILE;
SQL> SHUTDOWN IMMEDIATE;
SQL> STARTUP;

### 2.2 审计GoldenGate用户操作
SQL> AUDIT ALL BY fgedu BY ACCESS;
SQL> AUDIT SELECT TABLE, INSERT TABLE, UPDATE TABLE, DELETE TABLE BY fgedu BY ACCESS;

## 3. 配置密码管理

### 3.1 设置密码复杂度
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_LENGTH 12;
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_GRACE_TIME 7;
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME 90;
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_REUSE_TIME 365;
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_REUSE_MAX UNLIMITED;

### 3.2 定期更改密码
SQL> ALTER USER fgedu IDENTIFIED BY fgedu123456;

## 1. 创建GoldenGate系统用户

### 1.1 创建用户组
$ groupadd oinstall
$ groupadd dba

### 1.2 创建用户
$ useradd -g oinstall -G dba ggate
$ passwd ggate
Changing password for user ggate.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

## 2. 配置GoldenGate目录权限

### 2.1 创建目录
$ mkdir -p /GoldenGate/app
$ mkdir -p /GoldenGate/fgdata

### 2.2 设置权限
$ chown -R ggate:oinstall /GoldenGate
$ chmod -R 755 /GoldenGate

### 2.3 限制配置文件权限
$ chmod 600 /GoldenGate/app/dirprm/*

## 3. 配置系统安全

### 3.1 启用防火墙
$ systemctl start firewalld
$ systemctl enable firewalld

### 3.2 配置防火墙规则
$ firewall-cmd –add-port=7809/tcp –permanent
success
$ firewall-cmd –reload
success

### 3.3 限制SSH访问
$ vi /etc/ssh/sshd_config
# 允许的用户
AllowUsers ggate
# 禁用root登录
PermitRootLogin no
# 禁用密码登录
PasswordAuthentication no

$ systemctl restart sshd

## 4. 配置系统审计

### 4.1 启用auditd
$ systemctl start auditd
$ systemctl enable auditd

### 4.2 配置审计规则
$ vi /etc/audit/rules.d/audit.rules
# 审计GoldenGate目录
-w /GoldenGate -p wa -k ggate

$ auditctl -R /etc/audit/rules.d/audit.rules

## 1. 配置加密传输

### 1.1 生成密钥
$ cd /GoldenGate/app
$ openssl req -x509 -newkey rsa:2048 -keyout ggate.key -out ggate.crt -days 365 -nodes
Generating a 2048 bit RSA private key
……………..+++
………………….+++
writing new private key to ‘ggate.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:FGEDU
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server’s hostname) []:fgedu.net.cn
Email Address []:admin@fgedu.net.cn

### 1.2 配置GoldenGate加密
GGSCI> edit param mgr
PORT 7809
SECUREPARAMS /GoldenGate/app/ggate.key

### 1.3 配置Data Pump加密
GGSCI> edit param DP1
RMTHOST fgedu02, MGRPORT 7809, SECURE SSL

## 2. 配置网络访问控制

### 2.1 配置iptables
$ iptables -A INPUT -p tcp -s 192.168.1.0/24 –dport 7809 -j ACCEPT
$ iptables -A INPUT -p tcp –dport 7809 -j DROP
$ service iptables save

### 2.2 配置TCP Wrapper
$ vi /etc/hosts.allow
sshd: 192.168.1.

$ vi /etc/hosts.deny
sshd: ALL

## 3. 监控网络流量

### 3.1 安装网络监控工具
$ yum install -y ntopng

### 3.2 配置网络监控
$ systemctl start ntopng
$ systemctl enable ntopng

### 3.3 查看网络流量
$ ntopng -i eth0

## 环境信息
数据库：fgedudb (Oracle 19c)
GoldenGate版本：21.3.0.0.0
操作系统：Oracle Linux 8.5

## 配置步骤

### 1. 创建GoldenGate用户
SQL> CREATE USER fgedu IDENTIFIED BY fgedu123;
User created.

SQL> GRANT CREATE SESSION, ALTER SESSION TO fgedu;
Grant succeeded.

SQL> GRANT SELECT ANY DICTIONARY, SELECT ANY TABLE TO fgedu;
Grant succeeded.

SQL> GRANT FLASHBACK ANY TABLE TO fgedu;
Grant succeeded.

SQL> GRANT EXECUTE ON DBMS_FLASHBACK TO fgedu;
Grant succeeded.

SQL> GRANT EXECUTE ON DBMS_LOGMNR TO fgedu;
Grant succeeded.

### 2. 配置数据库审计
SQL> ALTER SYSTEM SET audit_trail=DB,EXTENDED SCOPE=SPFILE;
System altered.

SQL> SHUTDOWN IMMEDIATE;
Database closed.
Database dismounted.
ORACLE instance shut down.

SQL> STARTUP;
ORACLE instance started.

Total System Global Area 1610612736 bytes
Fixed Size 8896928 bytes
Variable Size 989855744 bytes
Database Buffers 603979776 bytes
Redo Buffers 7884800 bytes
Database mounted.
Database opened.

SQL> AUDIT ALL BY fgedu BY ACCESS;
Audit succeeded.

SQL> AUDIT SELECT TABLE, INSERT TABLE, UPDATE TABLE, DELETE TABLE BY fgedu BY ACCESS;
Audit succeeded.

### 3. 配置密码管理
SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_LENGTH 12;
Profile altered.

SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_GRACE_TIME 7;
Profile altered.

SQL> ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME 90;
Profile altered.

### 4. 验证配置
SQL> SELECT * FROM dba_users WHERE username = ‘FGEDU’;
USERNAME USER_ID PASSWORD ACCOUNT_STATUS LOCK_DATE EXPIRY_DATE
——————– ——- ——————————— ————— ———– ———–
FGEDU 101 ********************************* OPEN

SQL> SELECT * FROM dba_sys_privs WHERE grantee = ‘FGEDU’;
GRANTEE PRIVILEGE ADMIN_OPTION
———- —————————————- ————
FGEDU CREATE SESSION NO
FGEDU ALTER SESSION NO
FGEDU SELECT ANY DICTIONARY NO
FGEDU SELECT ANY TABLE NO
FGEDU FLASHBACK ANY TABLE NO

SQL> SELECT * FROM dba_tab_privs WHERE grantee = ‘FGEDU’;
GRANTEE OWNER TABLE_NAME PRIVILEGE GRANTABLE HIERARCHY
———- ———- ————— ———— ——— ———
FGEDU SYS DBMS_FLASHBACK EXECUTE NO NO
FGEDU SYS DBMS_LOGMNR EXECUTE NO NO

### 5. 配置结果
– GoldenGate用户已创建
– 必要的权限已授予
– 数据库审计已启用
– 密码管理已配置

## 环境信息
操作系统：Oracle Linux 8.5
GoldenGate版本：21.3.0.0.0

## 配置步骤

### 1. 创建GoldenGate系统用户
$ groupadd oinstall
$ groupadd dba
$ useradd -g oinstall -G dba ggate
$ passwd ggate
Changing password for user ggate.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

### 2. 配置GoldenGate目录权限
$ mkdir -p /GoldenGate/app
$ mkdir -p /GoldenGate/fgdata
$ chown -R ggate:oinstall /GoldenGate
$ chmod -R 755 /GoldenGate
$ chmod 600 /GoldenGate/app/dirprm/*

### 3. 配置系统安全
$ systemctl start firewalld
$ systemctl enable firewalld
$ firewall-cmd –add-port=7809/tcp –permanent
success
$ firewall-cmd –reload
success

### 4. 限制SSH访问
$ vi /etc/ssh/sshd_config
# 允许的用户
AllowUsers ggate
# 禁用root登录
PermitRootLogin no
# 禁用密码登录
PasswordAuthentication no

$ systemctl restart sshd

### 5. 配置系统审计
$ systemctl start auditd
$ systemctl enable auditd
$ vi /etc/audit/rules.d/audit.rules
# 审计GoldenGate目录
-w /GoldenGate -p wa -k ggate

$ auditctl -R /etc/audit/rules.d/audit.rules

### 6. 验证配置
$ ls -la /GoldenGate/
total 16
drwxr-xr-x. 4 ggate oinstall 4096 Apr 10 10:00 .
dr-xr-xr-x. 19 root root 4096 Apr 10 09:00 ..
drwxr-xr-x. 10 ggate oinstall 4096 Apr 10 10:00 app
drwxr-xr-x. 5 ggate oinstall 4096 Apr 10 10:00 fgdata

$ ls -la /GoldenGate/app/dirprm/
total 20
-rw——-. 1 ggate oinstall 100 Apr 10 10:00 EXT1.prm
-rw——-. 1 ggate oinstall 100 Apr 10 10:00 DP1.prm
-rw——-. 1 ggate oinstall 100 Apr 10 10:00 REP1.prm

$ firewall-cmd –list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: ssh dhcpv6-client
ports: 7809/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

### 7. 配置结果
– GoldenGate系统用户已创建
– 目录权限已配置
– 防火墙已启用并配置
– SSH访问已限制
– 系统审计已配置

## 环境信息
源端：fgedu01 (Oracle Linux 8.5)
目标端：fgedu02 (Oracle Linux 8.5)
GoldenGate版本：21.3.0.0.0

## 配置步骤

### 1. 生成密钥
$ cd /GoldenGate/app
$ openssl req -x509 -newkey rsa:2048 -keyout ggate.key -out ggate.crt -days 365 -nodes
Generating a 2048 bit RSA private key
……………..+++
………………….+++
writing new private key to ‘ggate.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:FGEDU
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server’s hostname) []:fgedu.net.cn
Email Address []:admin@fgedu.net.cn

### 2. 配置GoldenGate加密
GGSCI> edit param mgr
PORT 7809
SECUREPARAMS /GoldenGate/app/ggate.key

GGSCI> stop mgr
Manager process is required by other GGS processes.
Are you sure you want to stop it (y/n)? y
Sending STOP request to MANAGER …
Manager process stopped.

GGSCI> start mgr
Manager started.

### 3. 配置Data Pump加密
GGSCI> edit param DP1
EXTRACT DP1
PASSTHRU
RMTHOST fgedu02, MGRPORT 7809, SECURE SSL
RMTTRAIL /GoldenGate/fgdata/dirdat/rt
TABLE fgedu.*;

GGSCI> stop DP1
Sending STOP request to EXTRACT DP1 …
EXTRACT DP1 stopped.

GGSCI> start DP1
Sending START request to MANAGER …
EXTRACT DP1 starting

### 4. 配置网络访问控制
$ iptables -A INPUT -p tcp -s 192.168.1.0/24 –dport 7809 -j ACCEPT
$ iptables -A INPUT -p tcp –dport 7809 -j DROP
$ service iptables save

### 5. 验证配置
GGSCI> info all
Program Status Group Lag at Chkpt Time Since Chkpt
MANAGER RUNNING
EXTRACT RUNNING EXT1 00:00:00 00:00:05
EXTRACT RUNNING DP1 00:00:00 00:00:03
REPLICAT RUNNING REP1 00:00:00 00:00:02

$ iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp — 192.168.1.0/24 0.0.0.0/0 tcp dpt:7809
DROP tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:7809

### 6. 配置结果
– 密钥已生成
– GoldenGate加密已配置
– Data Pump加密已配置
– 网络访问控制已配置
– 所有进程运行正常