Scribd
Upload
45 views

SQL Server TDE

Uploaded by

gorgi.mahdi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
45 views

SQL Server TDE

Uploaded by

gorgi.mahdi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 3

#Enable Sql Server TDE

#------------------------------------

#--‫ جهت ساختن‬DMK ‫کد زیر را اجرا کنید‬


USE master
GO
IF NOT EXISTS(SELECT 1 FROM sys.symmetric_keys where name =
'##MS_DatabaseMasterKey##')
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Y@sSanatC0@#18521852'
GO

#--Check for master_key_encrypted_by_server


Use master
IF NOT EXISTS (select 1 from sys.databases where
[is_master_key_encrypted_by_server] = 1)
ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY
GO

#Create a Certificate:
--‫ جهت ساخت سرتیفیکیتی با اسم مثالی‬FSCert4TDE ‫کد زیر را اجرا کنید‬
Use master
IF NOT EXISTS (SELECT 1 FROM sys.certificates WHERE name = 'FSCert4TDE')
CREATE CERTIFICATE FSCert4TDE
WITH SUBJECT = 'Certificate for TDE',
START_DATE = '01/01/2024',
EXPIRY_DATE = '01/01/2500';
GO
--‫جهت بررسی ساخته شدن سرتیفیکیت کد زیر را اجرا کنید‬
select * from sys.certificates

#Create a Database Encryption Key-DEK:


USE [Marjan-FinalSecurity];
CREATE DATABASE ENCRYPTION KEY
WITH ALGORITHM = AES_256 --Supported encryption algorithms are AES with 128-bit,
192-bit, or 256-bit keys or 3 Key Triple DES
ENCRYPTION BY SERVER CERTIFICATE FSCert4TDE

#Enable TDE On Database:


USE [mssqltips_tde]
GO

ALTER DATABASE [Marjan-FinalSecurity]


SET ENCRYPTION ON
GO

#Backup Sql Server TDE Keys And Cert


------------------------------------------------
#--‫ در سرور مبدا‬SMK ‫ تهیه نسخه پشتیبان از‬- Backup Service Master KEY
BACKUP SERVICE MASTER KEY TO FILE='C:\TDE_Backup\SERVICE_MASTER_ KEY.bak'
ENCRYPTION BY PASSWORD='Y@sSanatC0@#18521852'
GO

#--‫ در سرور مبدا‬DMK ‫ تهیه نسخه پشتیبان از‬- Database Master KEY
BACKUP MASTER KEY TO FILE ='C:\TDE_Backup\Database_Master_KEY.bak'
ENCRYPTION BY PASSWORD ='Y@sSanatC0@#18521852'
GO
#Backing Up Certificates:
USE Master;
BACKUP CERTIFICATE FSTDECert
TO FILE = 'C:\TDE_Backup\SQLCert_FSTDECert_Backup.cer'
WITH PRIVATE KEY (FILE='C:\TDE_Backup\SQLCert_FSTDECert_PrivateKey.pvk',
ENCRYPTION BY PASSWORD='Y@sSanatC0@#18521852');

# Restore TDE
-----------------------
#--‫ در سرور مقصد‬SMK ‫بازیابی نسخه پشتیبان‬
RESTORE SERVICE MASTER KEY FROM FILE='C:\TDE_Test\SERVICE_MASTER_KEY.bak'
DECRYPTION BY PASSWORD='Y@sSanatC0@#18521852'
GO

#--‫ در سرور مقصد‬DMK ‫بازیابی نسخه پشتیبان‬


RESTORE MASTER KEY FROM FILE='C:\TDE_Backup\DATABASE_MASTER_KEY.bak'
DECRYPTION BY PASSWORD='Y@sSanatC0@#18521852'
ENCRYPTION BY PASSWORD='Y@sSanatC0@#18521852'
GO

#--‫ در سرور مقصد‬DMK ‫باز کردن‬


OPEN MASTER KEY DECRYPTION BY PASSWORD='Y@sSanatC0@#18521852'

#--‫ در سرور مقصد‬Certificate ‫بازیابی نسخه پشتیبان‬


CREATE CERTIFICATE TDECert FROM FILE ='C:\TDE_Backup\SQLCert_FSTDECert_Backup.bak'
WITH PRIVATE KEY
(
FILE='C:\TDE_Test\SQLCert_FSTDECert_PrivateKey.bak',
DECRYPTION BY PASSWORD='Y@sSanatC0@#18521852'
)
GO
------------------------------------------- Other Commands
--------------------------------------
# Fix Problem Disable Database After Sql Server Service Restart
OPEN MASTER KEY DECRYPTION BY PASSWORD = 'Y@sSanatC0@#18521852'
ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY
GO

#Alternatively a list of all the encrypted databases on an instance


SELECT name,DEK.*
FROM sys.databases D
JOIN sys.dm_database_encryption_keys DEK
ON DEK.database_id = D.database_id
ORDER BY name;

#Removing Encryption from a Database:


#-- Remove encryption
USE [Marjan-FinalSecurity];
ALTER DATABASE TDETest SET ENCRYPTION OFF;
GO

-- Remove DEK
DROP DATABASE ENCRYPTION KEY;

#--To monitor encryption progress you can use this query


select DB_NAME(database_id), * from sys.dm_database_encryption_keys

You might also like