My environment is as below -
Server: Oracle 12C 12.1.0.2.v17 ( AWS RDS Service)
Client: Windows 2012 machine with Oracle 19C 64 bit full client
Tools : SQL Developer and Toad on the client machine
I have configured native network encryption for the RDS service by following these instructions.
I set following options on the RDS -
SQLNET.ENCRYPTION_SERVER= Accepted
SQLNET.ENCRYPTION_TYPES_SERVER= AES256
The client Oracle 19c 64 bit home is C:\oracle\product\19.0.0\client_1\network\admin\sqlnet.ora
Both client tools using the TNS name in the above path; I verified this by using tnsping
The sqlnet.ora
in client has following options -
SQLNET.ENCRYPTION_CLIENT=REQUIRED
SQLNET.ENCRYPTION_TYPES_CLIENT=(AES256)
After the above configurations, I restarted my windows machine (just to make sure) and am able to establish connection to the RDS with Toad and SQL Developer tool.
MY question: How do I verify if my connection is encrypted ?
I tried executing below query -
select NETWORK_SERVICE_BANNER
from v$session_connect_info
where SID = sys_context('USERENV','SID');
The output I am seeing is
TCP/IP NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production
Encryption service for Linux: Version 12.1.0.2.0 - Production
Crypto-checksumming service for Linux: Version 12.1.0.2.0 - Production
SHA1 Crypto-checksumming service adapter for Linux: Version 12.1.0.2.0 - Production
I do not see "AES256 Encryption" in the NETWORK_SERVICE_BANNER
output.
Related question: I need all the client connections from this machine to my server use encryption. Is there a way I can enforce this by using logon trigger ?
required
and on client set the encryption torejected
. I made sure Toad, SQL Developer are using the thick client . With these options set, I could not connect to the server from Toad, SQL Developer or SQL Plus. This shows the encryption options are working. I Just need to confirm from the server that the client connections are using encryption. I do not want to set encryption torequired
on the server permanently as there are other client connections that do not need to be encrypted.