# 步骤1：创建Credential Store
GGSCI (fgedu.net.cn)> ADD CREDENTIALS

Credential store created in /GoldenGate/app/dircrd/.

# 步骤2：验证Credential Store
GGSCI (fgedu.net.cn)> INFO CREDENTIALS

Credential store domain: OracleGoldenGate
Credential store location: /GoldenGate/app/dircrd/
Credential store size: 4096 bytes

# 步骤3：添加数据库凭证
GGSCI (fgedu.net.cn)> ALTER CREDENTIALS ADD USER fgedu, PASSWORD fgedu123, ALIAS fgedu_alias

Credentials added for alias ‘fgedu_alias’.

# 步骤4：验证凭证
GGSCI (fgedu.net.cn)> INFO CREDENTIALS

Alias: fgedu_alias
Userid: fgedu
Domain: OracleGoldenGate

# 步骤5：使用凭证登录
GGSCI (fgedu.net.cn)> DBLOGIN USERIDALIAS fgedu_alias

Successfully logged into database.

# 步骤6：修改参数文件使用别名
# 修改前
EXTRACT E_FGEDU01
USERID fgedu, PASSWORD fgedu123
EXTTRAIL /GoldenGate/app/dirdat/ea
TABLE fgedu01.*;

# 修改后
EXTRACT E_FGEDU01
USERIDALIAS fgedu_alias
EXTTRAIL /GoldenGate/app/dirdat/ea
TABLE fgedu01.*;

# 步骤7：更新凭证
GGSCI (fgedu.net.cn)> ALTER CREDENTIALS REPLACE USER fgedu, PASSWORD newpassword, ALIAS fgedu_alias

Credentials replaced for alias ‘fgedu_alias’.

# 步骤8：删除凭证
GGSCI (fgedu.net.cn)> ALTER CREDENTIALS DELETE ALIAS fgedu_alias

Credentials deleted for alias ‘fgedu_alias’.

# 步骤9：设置Credential Store权限
$ chmod 700 /GoldenGate/app/dircrd
$ chown ogg:ogg /GoldenGate/app/dircrd
$ ls -la /GoldenGate/app/dircrd/

total 8
drwx—— 2 ogg ogg 4096 Apr 10 10:00 .
drwxr-x— 8 ogg ogg 4096 Apr 10 10:00 ..
-rw——- 1 ogg ogg 4096 Apr 10 10:00 cwallet.sso

# 步骤1：创建Wallet目录
$ mkdir -p /GoldenGate/app/wallet
$ chmod 700 /GoldenGate/app/wallet

# 步骤2：创建Wallet
$ orapki wallet create -wallet /GoldenGate/app/wallet -pwd WalletPass123 -auto_login

Oracle PKI Tool : Version 19.0.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
Wallet created.

# 步骤3：添加凭证到Wallet
$ mkstore -wrl /GoldenGate/app/wallet -createEntry oracle.fgedu.credentials fgedu/fgedu123

Oracle Secret Store Tool : Version 19.0.0.0.0
Copyright (c) 2004, 2019, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
Create credential oracle.fgedu.credentials.

# 步骤4：配置OGG使用Wallet
# 在GLOBALS文件中配置
GGSCI (fgedu.net.cn)> EDIT PARAMS ./GLOBALS

WALLETLOCATION /GoldenGate/app/wallet

# 步骤5：生成加密密钥
GGSCI (fgedu.net.cn)> OPEN WALLET
Wallet opened.

GGSCI (fgedu.net.cn)> CREATE ENCRYPTKEY mykey
Encryption key ‘mykey’ created.

# 步骤6：列出密钥
GGSCI (fgedu.net.cn)> INFO ENCRYPTKEY

Encryption key name: mykey
Algorithm: AES256
Created: 2026-04-10 10:00:00

# 步骤7：使用密钥加密密码
GGSCI (fgedu.net.cn)> ENCRYPT PASSWORD mypassword ALGORITHM AES256 ENCRYPTKEY mykey

Encrypted password: AACAAAAAAAAAAAJAUEPOMEW…

# 步骤8：配置参数文件使用加密密码
EXTRACT E_FGEDU01
USERID fgedu, PASSWORD AACAAAAAAAAAAAJAUEPOMEW…, ENCRYPTKEY mykey
EXTTRAIL /GoldenGate/app/dirdat/ea
TABLE fgedu01.*;

# 步骤1：创建加密密钥
GGSCI (fgedu.net.cn)> OPEN WALLET
GGSCI (fgedu.net.cn)> CREATE ENCRYPTKEY trail_key

Encryption key ‘trail_key’ created.

# 步骤2：配置Extract加密Trail
GGSCI (fgedu.net.cn)> EDIT PARAMS E_FGEDU01

EXTRACT E_FGEDU01
USERIDALIAS fgedu_alias

— 启用Trail加密
ENCRYPTTRAIL AES256 KEYNAME trail_key

EXTTRAIL /GoldenGate/app/dirdat/ea
TABLE fgedu01.*;

# 步骤3：配置Data Pump加密传输
GGSCI (fgedu.net.cn)> EDIT PARAMS P_FGEDU01

EXTRACT P_FGEDU01
USERIDALIAS fgedu_alias

— 加密网络传输
RMTHOST target-host, MGRPORT 7809, ENCRYPT AES256 KEYNAME trail_key

RMTTRAIL /GoldenGate/app/dirdat/ra
TABLE fgedu01.*;

# 步骤4：配置Replicat解密Trail
GGSCI (target-host)> EDIT PARAMS R_FGEDU01

REPLICAT R_FGEDU01
USERIDALIAS fgedu_alias

— 解密Trail文件
DECRYPTTRAIL AES256 KEYNAME trail_key

ASSUMETARGETDEFS
MAP fgedu01.*, TARGET fgedu01.*;

# 步骤5：重启进程应用加密配置
GGSCI (fgedu.net.cn)> STOP EXTRACT E_FGEDU01
GGSCI (fgedu.net.cn)> START EXTRACT E_FGEDU01

# 步骤6：验证加密效果
# 查看Trail文件内容（加密后为乱码）
$ strings /GoldenGate/app/dirdat/ea000000 | head

�~�_�]�;�”�$�,�0�4�8�<�@�D�H�L�P�T�X�\�`�d�h�l�p�t�x�|����� # 步骤7：检查加密状态 GGSCI (fgedu.net.cn)> INFO EXTRACT E_FGEDU01

EXTRACT E_FGEDU01 Last Started 2026-04-10 10:00:00 Status RUNNING
Checkpoint Lag 00:00:00 (updated 00:00:05 ago)
Trail Encryption AES256 (KEYNAME trail_key)

# 步骤1：生成SSL证书
# 创建证书目录
$ mkdir -p /GoldenGate/app/certs
$ cd /GoldenGate/app/certs

# 生成私钥
$ openssl genrsa -out server.key 2048

Generating RSA private key, 2048 bit long modulus
……………………….+++
………..+++
e is 65537 (0x10001)

# 生成证书签名请求
$ openssl req -new -key server.key -out server.csr

You are about to be asked to enter information that will be incorporated
into your certificate request.
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:FGEDU
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server’s hostname) []:fgedu.net.cn
Email Address []:admin@fgedu.net.cn

# 生成自签名证书
$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=FGEDU/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
Getting Private key

# 步骤2：配置Manager SSL
GGSCI (fgedu.net.cn)> EDIT PARAMS MGR

PORT 7809
PURGEOLDEXTRACTS /GoldenGate/app/dirdat/*, USECHECKPOINTS

— SSL配置
SSL_CERTIFICATE /GoldenGate/app/certs/server.crt
SSL_PRIVATEKEY /GoldenGate/app/certs/server.key

# 步骤3：重启Manager
GGSCI (fgedu.net.cn)> STOP MANAGER
GGSCI (fgedu.net.cn)> START MANAGER

# 步骤4：配置客户端SSL连接
# 在目标端配置
GGSCI (target-host)> EDIT PARAMS P_FGEDU01

EXTRACT P_FGEDU01
USERIDALIAS fgedu_alias

— SSL连接
RMTHOST source-host, MGRPORT 7809, SSL
RMTTRAIL /GoldenGate/app/dirdat/ra
TABLE fgedu01.*;

# 步骤5：验证SSL连接
$ openssl s_client -connect fgedu.net.cn:7809 -showcerts

CONNECTED(00000003)
depth=0 C = CN, ST = Beijing, L = Beijing, O = FGEDU, OU = IT, CN = fgedu.net.cn
verify error:num=18:self signed certificate
verify return:1
depth=0 C = CN, ST = Beijing, L = Beijing, O = FGEDU, OU = IT, CN = fgedu.net.cn
verify return:1
—
Certificate chain
0 s:/C=CN/ST=Beijing/L=Beijing/O=FGEDU/OU=IT/CN=fgedu.net.cn
i:/C=CN/ST=Beijing/L=Beijing/O=FGEDU/OU=IT/CN=fgedu.net.cn
—
from GoldenGate视频:www.itpux.com

# 步骤1：配置命令审计
GGSCI (fgedu.net.cn)> EDIT PARAMS MGR

PORT 7809
PURGEOLDEXTRACTS /GoldenGate/app/dirdat/*, USECHECKPOINTS

— 启用命令审计
COMMANDAUDIT ON

— 审计日志位置
ACCESSLOG /GoldenGate/app/logs/access.log

# 步骤2：配置访问控制
GGSCI (fgedu.net.cn)> EDIT PARAMS MGR

PORT 7809

— 访问控制规则
ACCESSRULE, PROG *, USER ogg, ALLOW
ACCESSRULE, PROG *, IPADDR 192.168.1.*, ALLOW
ACCESSRULE, PROG *, IPADDR 10.*, ALLOW
ACCESSRULE, PROG *, DENY

# 步骤3：创建审计日志收集脚本
#!/bin/bash
# audit_log_collect.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

OGG_HOME=/GoldenGate/app
AUDIT_LOG=/GoldenGate/app/logs/audit.log
ACCESS_LOG=/GoldenGate/app/logs/access.log
CENTRAL_LOG=/var/log/ogg-audit/

mkdir -p $CENTRAL_LOG

# 收集审计日志
collect_audit_logs() {
echo “=== 审计日志收集 $(date) ===” >> $CENTRAL_LOG/daily_audit.log

# 收集访问日志
if [ -f $ACCESS_LOG ]; then
echo “— 访问日志 —” >> $CENTRAL_LOG/daily_audit.log
tail -100 $ACCESS_LOG >> $CENTRAL_LOG/daily_audit.log
fi

# 收集进程报告
echo “— 进程报告 —” >> $CENTRAL_LOG/daily_audit.log
for report in $OGG_HOME/dirrpt/*.rpt; do
echo “文件: $report” >> $CENTRAL_LOG/daily_audit.log
tail -50 $report >> $CENTRAL_LOG/daily_audit.log
done

# 收集错误日志
echo “— 错误日志 —” >> $CENTRAL_LOG/daily_audit.log
for err in $OGG_HOME/dirrpt/*.err; do
if [ -f $err ]; then
echo “文件: $err” >> $CENTRAL_LOG/daily_audit.log
cat $err >> $CENTRAL_LOG/daily_audit.log
fi
done
}

# 分析安全事件
analyze_security_events() {
echo “=== 安全事件分析 $(date) ===” >> $CENTRAL_LOG/security_events.log

# 检查认证失败
grep -i “authentication failed\|login failed\|access denied” $ACCESS_LOG >> $CENTRAL_LOG/security_events.log

# 检查异常访问
grep -i “unauthorized\|invalid\|error” $ACCESS_LOG >> $CENTRAL_LOG/security_events.log
}

collect_audit_logs
analyze_security_events

# 步骤4：设置定时任务
$ crontab -e
# 每小时收集审计日志
0 * * * * /GoldenGate/app/scripts/audit_log_collect.sh

# 步骤5：验证审计配置
GGSCI (fgedu.net.cn)> SEND MANAGER GETCONFIG

Manager Parameters:
PORT 7809
PURGEOLDEXTRACTS /GoldenGate/app/dirdat/*, USECHECKPOINTS
COMMANDAUDIT ON
ACCESSLOG /GoldenGate/app/logs/access.log

# 步骤6：查看审计日志
$ cat /GoldenGate/app/logs/access.log

2026-04-10 10:00:00 INFO OGG-00983 Manager started.
2026-04-10 10:00:05 INFO OGG-00989 Command: INFO ALL, User: ogg, IP: 192.168.1.100
2026-04-10 10:00:10 INFO OGG-00989 Command: START EXTRACT E_FGEDU01, User: ogg, IP: 192.168.1.100

# 项目背景
– 环境：银行核心系统数据同步
– 要求：等保三级、PCI DSS合规
– 数据：敏感金融数据

# 安全加固措施

# 1. 凭证安全
– 所有凭证使用Credential Store存储
– 密码复杂度要求：16位，包含大小写字母、数字、特殊字符
– 密码定期更换：90天

# 2. 数据加密
– Trail文件加密：AES256
– 网络传输加密：SSL/TLS
– 数据库连接加密：Oracle Net加密

# 3. 访问控制
– IP白名单限制
– 用户权限最小化
– 操作审计记录

# 4. 安全监控
– 实时监控异常访问
– 安全事件告警
– 定期安全审计

# 实施效果
| 安全项 | 实施前 | 实施后 |
|—————-|————-|————-|
| 凭证存储 | 明文存储 | 加密存储 |
| 数据传输 | 明文传输 | SSL加密 |
| 访问控制 | 无限制 | IP白名单 |
| 审计日志 | 无 | 完整审计 |
| 合规状态 | 不合规 | 合规 |

# 关键配置
# Credential Store配置
GGSCI> ADD CREDENTIALS
GGSCI> ALTER CREDENTIALS ADD USER fgedu, PASSWORD “Fg@2026#Secure!”, ALIAS fgedu_alias

# Trail加密配置
EXTRACT E_FGCORE
USERIDALIAS fgedu_alias
ENCRYPTTRAIL AES256 KEYNAME core_key
EXTTRAIL /GoldenGate/app/dirdat/core
TABLE FGCORE.*;

# 访问控制配置
ACCESSRULE, PROG *, USER ogg_admin, ALLOW
ACCESSRULE, PROG *, IPADDR 10.0.0.0/8, ALLOW
ACCESSRULE, PROG *, DENY

# 问题1：Credential Store无法访问
# 错误信息
ERROR OGG-02541 Credential store is corrupted or inaccessible.

# 原因分析
– 文件权限不正确
– Wallet文件损坏
– 密码错误

# 解决方案
# 1. 检查文件权限
$ ls -la /GoldenGate/app/dircrd/
drwx—— 2 ogg ogg 4096 Apr 10 10:00 .

# 2. 修复权限
$ chmod 700 /GoldenGate/app/dircrd
$ chown -R ogg:ogg /GoldenGate/app/dircrd

# 3. 重建Credential Store
GGSCI> DELETE CREDENTIALS
GGSCI> ADD CREDENTIALS

# 问题2：SSL证书验证失败
# 错误信息
ERROR OGG-01201 SSL handshake failed.

# 原因分析
– 证书过期
– 证书不匹配
– 证书链不完整

# 解决方案
# 1. 检查证书有效期
$ openssl x509 -in server.crt -noout -dates

notBefore=Apr 10 00:00:00 2026 GMT
notAfter=Apr 10 23:59:59 2027 GMT

# 2. 验证证书
$ openssl verify server.crt

# 3. 重新生成证书
$ openssl req -new -x509 -days 365 -key server.key -out server.crt

# 问题3：加密密钥丢失
# 错误信息
ERROR OGG-00722 Encryption key not found.

# 原因分析
– Wallet文件丢失
– 密钥被删除
– Wallet路径错误

# 解决方案
# 1. 恢复Wallet备份
$ cp /backup/wallet/* /GoldenGate/app/wallet/

# 2. 重新创建密钥
GGSCI> OPEN WALLET
GGSCI> CREATE ENCRYPTKEY new_key

# 3. 更新配置使用新密钥

# 解决方案1：完整安全检查脚本
#!/bin/bash
# security_check.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

OGG_HOME=/GoldenGate/app
REPORT_FILE=/GoldenGate/app/logs/security_report.txt

echo “=== OGG安全检查报告 ===” > $REPORT_FILE
echo “检查时间: $(date)” >> $REPORT_FILE
echo “” >> $REPORT_FILE

# 1. 检查Credential Store
echo “1. Credential Store检查:” >> $REPORT_FILE
if [ -d “$OGG_HOME/dircrd” ]; then
perms=$(stat -c %a $OGG_HOME/dircrd)
if [ “$perms” = “700” ]; then
echo ” [OK] Credential Store权限正确” >> $REPORT_FILE
else
echo ” [警告] Credential Store权限不正确: $perms” >> $REPORT_FILE
fi
else
echo ” [错误] Credential Store不存在” >> $REPORT_FILE
fi

# 2. 检查参数文件中的明文密码
echo “” >> $REPORT_FILE
echo “2. 参数文件检查:” >> $REPORT_FILE
for prm in $OGG_HOME/dirprm/*.prm; do
if grep -q “PASSWORD” $prm | grep -v “ENCRYPTKEY” | grep -v “USERIDALIAS”; then
echo ” [警告] 发现明文密码: $prm” >> $REPORT_FILE
fi
done

# 3. 检查Trail加密
echo “” >> $REPORT_FILE
echo “3. Trail加密检查:” >> $REPORT_FILE
for prm in $OGG_HOME/dirprm/*.prm; do
if grep -q “EXTRACT” $prm && ! grep -q “ENCRYPTTRAIL” $prm; then
echo ” [警告] Extract未启用Trail加密: $prm” >> $REPORT_FILE
fi
done

# 4. 检查访问控制
echo “” >> $REPORT_FILE
echo “4. 访问控制检查:” >> $REPORT_FILE
if grep -q “ACCESSRULE” $OGG_HOME/dirprm/mgr.prm; then
echo ” [OK] 已配置访问控制规则” >> $REPORT_FILE
else
echo ” [警告] 未配置访问控制规则” >> $REPORT_FILE
fi

# 5. 检查审计日志
echo “” >> $REPORT_FILE
echo “5. 审计日志检查:” >> $REPORT_FILE
if grep -q “COMMANDAUDIT” $OGG_HOME/dirprm/mgr.prm; then
echo ” [OK] 已启用命令审计” >> $REPORT_FILE
else
echo ” [警告] 未启用命令审计” >> $REPORT_FILE
fi

# 6. 检查文件权限
echo “” >> $REPORT_FILE
echo “6. 文件权限检查:” >> $REPORT_FILE
dir_perms=$(stat -c %a $OGG_HOME)
if [ “$dir_perms” = “750” ] || [ “$dir_perms” = “700” ]; then
echo ” [OK] OGG目录权限正确: $dir_perms” >> $REPORT_FILE
else
echo ” [警告] OGG目录权限不正确: $dir_perms” >> $REPORT_FILE
fi

echo “” >> $REPORT_FILE
echo “=== 检查完成 ===” >> $REPORT_FILE

cat $REPORT_FILE

# 解决方案2：安全加固自动化脚本
#!/bin/bash
# security_hardening.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

OGG_HOME=/GoldenGate/app

# 1. 设置文件权限
echo “设置文件权限…”
chmod 750 $OGG_HOME
chmod 700 $OGG_HOME/dircrd
chmod 700 $OGG_HOME/wallet
chmod 600 $OGG_HOME/dirprm/*.prm

# 2. 配置访问控制
echo “配置访问控制…”
if ! grep -q “ACCESSRULE” $OGG_HOME/dirprm/mgr.prm; then
echo “” >> $OGG_HOME/dirprm/mgr.prm
echo “– 访问控制规则” >> $OGG_HOME/dirprm/mgr.prm
echo “ACCESSRULE, PROG *, USER ogg, ALLOW” >> $OGG_HOME/dirprm/mgr.prm
echo “ACCESSRULE, PROG *, IPADDR 192.168.1.*, ALLOW” >> $OGG_HOME/dirprm/mgr.prm
echo “ACCESSRULE, PROG *, DENY” >> $OGG_HOME/dirprm/mgr.prm
fi

# 3. 启用命令审计
echo “启用命令审计…”
if ! grep -q “COMMANDAUDIT” $OGG_HOME/dirprm/mgr.prm; then
echo “COMMANDAUDIT ON” >> $OGG_HOME/dirprm/mgr.prm
fi

echo “安全加固完成”