Chat now with support
Chat with Support

SharePlex 8.6.6 - Administration Guide

About this Guide Conventions used in this guide Overview of SharePlex Run SharePlex Run multiple instances of SharePlex Execute commands in sp_ctrl SharePlex parameters Prepare an Oracle environment for replication Create a configuration file Configure replication to Open Target targets Configure a replication strategy Configure partitioned replication Configure named queues Configure SharePlex to maintain a change history target Replicate Oracle DDL Set up error handling Transform data Configure SharePlex security features Activate replication in your production environment Monitor SharePlex Prevent and solve replication problems Repair out-of-sync Data Procedures to maintain Oracle high availability Make changes to an active replication environment Apply an Oracle application patch or upgrade Back up Oracle data on the source or target Tune the Capture process Tune the Post process Appendix A: Peer-To-Peer Diagram Appendix B: SharePlex environment variables

Encrypt data across the network

Configure SharePlex security features > Encrypt data across the network

SharePlex encryption provides the ability to encrypt replicated data across the network. SharePlexuses industry-standard Advanced Encryption Standard (AES) encryption.

The Export process controls whether encryption is performed and the size of the key. It communicates these factors to the Import process.

To configure encryption

  1. Review the Encryption guidelines.

On the source system:

  1. Enable encryption in SharePlex by setting the SP_XPT_ENABLE_AES parameter to 1. See Enable encryption on the source system
  2. (Optional) Set the size of the key by setting the SP_XPT_AES_KEY_LENGTH parameter to the desired length (128-the default, 192, 256 bits). See Set the key size on the source system.
  3. Create an encryption key by running the create encryption key command. See Create an encryption key on the source system.

On the source and target systems:

  1. Run the set encryption key command. See Set the key on the source and target.

On the source system:

  1. Stop and start Export to activate the SP_XPT_ENABLE_AES parameter.

Encryption guidelines

  • Use one encryption key for all Export processes in the SharePlex instance.
  • SharePlex on both the source and target must be of a version that supports encryption (version 8.6.3 or later).

Enable encryption on the source system

Set the Export parameter SP_XPT_ENABLE_AES to 1 on the source system. By default, this parameter is set to 0 (encryption is disabled).

sp_ctrl> set param sp_xpt_enable_aes 1

Restart Export to activate this setting after you finish configuring encryption.

Set the key size on the source system

By default the AES key size is 128 bits. To increase the key size to 192 or 256 bits, set the Export parameter SP_XPT_AES_KEY_LENGTH to the desired length on the source system. The parameter takes effect the next time that Export starts.

sp_ctrl> set param sp_xpt_aes_key_length {128 | 192 | 256}

Create an encryption key on the source system

Run the following command in sp_ctrl on the source system:

sp_ctrl> create encryption key

The command returns a randomly generated AES key, for example: E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4.

Note: This command only generates the key. You must set the key on all systems. See Set the key on the source and target.

Set the key on the source and target

The encryption key must be set on the source system plus all of the target systems.

To set a key

Run the following command in sp_ctrl on the source and target systems.

sp_ctrl> set encryption key key

Component Description
key

The encryption key that was generated by the create encryption key command. The key must be set to the entire value that was generated by create encryption key. It must be 64 bytes long.

Without further options, the command affects all routes.

Example:

sp_ctrl> set encryption key E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4

Example

The following example creates and sets the encryption key.

On the source:

sp_ctrl> create encryption key

On target 1:

sp_ctrl> set encryption key E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4

On target 2:

sp_ctrl>set encryption key E5F5D4CBA329D2C86B5D7ABA096C18600595490129F55A1422AAB0248B28D0E4

View and reset encryption

To view the encryption key

Use the show encryption key command to view the key that is being used by SharePlex.

sp_ctrl> show encryption key

To reset the encryption key

Use the reset encryption key command to remove the encryption key.

sp_ctrl> reset encryption key

Assign SharePlex users to security groups

Configure SharePlex security features > Assign SharePlex users to security groups

The SharePlex security groups provide access control to the SharePlex command and control system. Without proper configuration of these groups, anyone with permissions on the system can use the commands that view, configure, and control data replication.

Overview of SharePlex security groups

To monitor, control, or change SharePlex replication, a person must be assigned to one of the SharePlex security groups on the systems where he or she will be issuing commands. Each group corresponds to an authorization level, which determines which SharePlex commands a person can issue. To execute a command, a user must have that command’s authorization level or higher.

Use the authlevel command to determine your authorization level for issuing SharePlex commands on a system.

Description of the SharePlex security groups

Refer to the following table to determine the group and authorization level that you want to grant each SharePlex user.

User Authorization Levels and Roles
Auth level User type User group User roles
1 Administration spadmin*

You need at least one user with Administrator rights on each source and target system.

Can issue all SharePlex commands. Commands that can only be issued by a SharePlex Administrator are:

  • startup, shutdown
  • all configuration commands relating to an active configuration
  • all parameter commands except list param
  • start capture
  • stop capture
  • abort capture
  • truncate log

The SharePlex Administrator user must be in the Oracle dba group. For Oracle RAC and ASM 11gR2 and above, the user must also be in the Oracle Inventory group. For example: $ useradd –g spadmin –G dba,oinstall. The membership in Oracle Inventory group must be listed explicitly in the etc/group file.

On Unix and Linux, unless you install SharePlex as a root user, the SharePlex Administrator user and the SharePlex admin group must exist prior to installation.

2 Operator spopr Can issue all SharePlex commands except those listed above.
3 Viewer spview Can view lists, status screens, and logs to monitor replication only.

Note: The default name for the SharePlex administrator group is spadmin, but you can designate any group or specify any name for that group during installation.

Create and populate SharePlex groups on Unix and Linux

Configure SharePlex security features > Assign SharePlex users to security groups > Create and populate SharePlex groups on Unix and Linux

Where and when to create the SharePlex groups on Unix and Linux depends on whether you install SharePlex as a root or non-root user.

  • If you install as non-root, create the groups in the /etc/group file before you run the SharePlex installer. In a cluster, create them on all nodes.*
  • If you install SharePlex as a root user, you can direct the installer to create the groups in the /etc/group file. If you install in a cluster, the installer creates the groups on the primary node, but you must create them yourself on the other nodes.

* The groups must exist because the installer adds the SharePlex Administrator user to the spadmin group during the installation process. In a cluster, this user is only added to the primary node. You must add the SharePlex Administrator user to the other nodes.

To create the groups in /etc/group

# groupadd spadmin

# groupadd spopr

# groupadd spview

To assign a user to a group

  1. Open the /etc/group file.
  2. Add the Unix or Linux user name to the appropriate group. To assign a list of user names to a group, use a comma-separated list (see the following example).

    spadmin:*:102:spadmin,root,jim,jane,joyce,jerry

    If the password field is null, no password is associated with the group. In the example, the asterisk (*) represents the password, “102” represents the numerical group ID, and spadmin is the group. The group ID must be unique.

  3. Save the file.

Users can verify their authorization levels by issuing the authlevel command in sp_ctrl.

Related Documents