GaussDB Kernel: Checking the CREATEROLE Permission

Only the role with the CREATEROLE permission can create, modify, or delete other roles. Such a role can also grant permissions to or revoke permissions of other roles. To avoid arbitrary permission granting, delete roles that do not require the CREATEROLE permission. Copyright C 2020 Greenbone...

GaussDB Kernel: Changing the Password of the Initial User

An initial user is the system administrator with the ID 10 and has the highest permission in GaussDB Kernel. This user cannot be modified or locked. Change the password of this user after the database is installed. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted...

GaussDB Kernel: Setting user for host Entries in the pg_hba.conf File

If user is set to all for host entries, any users are allowed to access the database. You are advised to set user for host entries to the user who needs to connect to the database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and ar...

GaussDB Kernel: Configuring the Number of Days Before Which a Password Cannot Be Reused

You are advised to configure the number of days before which a password cannot be reused. This protects a password from being cracked due to repeated usage. After the parameter passwordreusetime is set, a password can be reused only after the number of days specified by the parameter. Copyright C...

GaussDB Kernel: Enabling the Logging of User Logout

Similar to logconnections, a record containing a session duration is added to the server log at the end of the session. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Deleting hostnossl Entries from the pg_hba.conf File

The connections specified by the hostnossl entries are not encrypted using SSL. Considering security, you are advised to use the SSL connection. SSL can be used for connections between the CN and external nodes but not for connections between internal nodes. Copyright C 2020 Greenbone Networks Gm...

GaussDB Kernel: Revoking the CREATE Permission from a User with the PUBLIC Role

A common user can create malicious functions with the same names as system functions if the user has the PUBLIC role. In this way, other users can call these malicious functions by mistake to compromise database security. If the PUBLIC role has the CREATE permission, any user having this role can...

GaussDB Kernel: Documenting Database Templates

All database templates must be documented. You need to carefully check any database templates without specific use. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Configuring the Password Encryption Mode

GaussDB Kernel supports two password encryption modes: MD5 and SHA256. MD5 is an insecure encryption mode and should not be configured. This mode is reserved only for compatibility with open-source third-party tools. SHA256 default configuration should be used. Copyright C 2020 Greenbone Networks...

GaussDB Kernel: Configuring the Validity Period of User Roles

During role creation, the keyword VALID BEGIN is used to set the role validity start time and VALID UNTIL to set the end time. If these two keywords are not set, roles are permanently valid. The role expiration time on each node in the GaussDB Kernel cluster depends on the OS clock on each node...

GaussDB Kernel: Configuring the SSL Protocol

The SSL protocol improves data security and integrity for network communications. You are strongly advised to use SSL for TCP or IP connections when using the database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

GaussDB Kernel: Restricting the Permission for the postgresql.conf File

The configuration file postgresql.conf stores the default database configuration. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone...

GaussDB Kernel: Configuring the SSL Encryption Algorithm

sslciphers specifies the SSL encryption algorithms used for secure connections. GaussDB Kernel supports the following algorithms: - DHE-RSA-AES128-GCM-SHA256 - DHE-RSA-AES256-GCM-SHA384 - DHE-RSA-AES128-CCM - DHE-RSA-AES256-CCM You are advised to set sslciphers to ALL. Then, GaussDB Kernel uses...

GaussDB Kernel: Configuring the Port

To prevent unauthorized connections to the database and illegal operations on data, you need to change the default port number in time. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Disabling the Permission to Copy Files on the Server

The enablecopyserverfiles parameter allows users with the sysadmin permission to copy files on the server. However, sensitive files may be viewed or modified by unauthorized users during remote copy operations. Therefore, disable this configuration for databases in the production environment. The...

GaussDB Kernel: Configuring the Permission to Access UNIX Domain Sockets

unixsocketpermissions specifies the permission to access UNIX domain sockets. The default value of this parameter is 0777, indicating that all users can access UNIX domain sockets. You are advised to set this parameter to 0770 indicating that only users and groups can access UNIX domain sockets o...

GaussDB Kernel: Configuring the Backslash Quote Usage

backslashquote specifies whether a single quotation mark Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

GaussDB Kernel: Restricting the Permission for the Data Directory

The data directory stores user data files. To prevent them from being tampered or damaged and protect customer data from security threats, this directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a...

GaussDB Kernel: Configuring the Maximum Logging Duration of An Audit Log File

The parameter auditrotationinterval specifies the maximum logging duration of an audit log file. After the time expires, another audit log file is automatically Created. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright...

GaussDB Kernel: Restricting the Permission for the pg_hba.conf File

The configuration file pghba.conf stores the configuration information about database connections. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C...