GaussDB Kernel: Configuring Log File Permissions

After loggingcollector is set to on, you can set logfilemode to specify server log file permissions. Access to log files must be restricted, because the log files may contain sensitive data. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

GaussDB Kernel: Prohibiting host Entries from Using MD5 Authentication in the pg_hba.conf File

MD5 authentication is insecure. You are advised to use SHA256 authentication. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...

GaussDB Kernel: Enabling the Logging of User Logout

Similar to logconnections, a record containing a session duration is added to the server log at the end of the session. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Configuring the Levels of Logs to Be Written into the Server

The parameter logerrorverbosity specifies the level of logs to be written into the server. The value can be TERSE, DEFAULT, or VERBOSE. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Configuring the Password Complexity Check

For database security purposes, password complexity is checked during user creation and password changes. Passwords not meeting complexity requirements are not allowed in GaussDB Kernel. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources,...

GaussDB Kernel: Configure an Audit Priority Policy

Configures the policy for determining whether audit logs are preferentially stored by space or time. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

GaussDB Kernel: Configuring the Backslash Quote Usage

backslashquote specifies whether a single quotation mark Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

GaussDB Kernel: Changing the Password of the Initial User

An initial user is the system administrator with the ID 10 and has the highest permission in GaussDB Kernel. This user cannot be modified or locked. Change the password of this user after the database is installed. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted...

GaussDB Kernel: Prohibiting New Connections to Database Templates

To prevent improper modification of the database template, you need to set the datallowconn field in the system catalog pgdatabase to false, prohibiting new connections to the database. If the database template template1 is set to deny user connections, database upgrade will be affected. If...

GaussDB Kernel: Configuring the Client Log Message Level

The parameter clientminmessages specifies the level of messages to be sent to the client. The valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, LOG, NOTICE, WARNING, ERROR, FATAL, and PANIC. It must be NOTICE at least. After a level is selected, messages at this level and its lower...

GaussDB Kernel: Unknown Roles

Check the purpose of each unknown role in the query and delete unnecessary Roles. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

GaussDB Kernel: Restricting the Permission for the postgresql.conf File

The configuration file postgresql.conf stores the default database configuration. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone...

GaussDB Kernel: Setting user for host Entries in the pg_hba.conf File

If user is set to all for host entries, any users are allowed to access the database. You are advised to set user for host entries to the user who needs to connect to the database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and ar...

GaussDB Kernel: Specifying the Listening IP Address for the GDS Module

For the GDS module, you are advised to listen on the specified explicit IP addresses on a network segment to listen on the connections to the network Segment. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

GaussDB Kernel: Documenting Database Templates

All database templates must be documented. You need to carefully check any database templates without specific use. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

GaussDB Kernel: Checking the CREATEROLE Permission

Only the role with the CREATEROLE permission can create, modify, or delete other roles. Such a role can also grant permissions to or revoke permissions of other roles. To avoid arbitrary permission granting, delete roles that do not require the CREATEROLE permission. Copyright C 2020 Greenbone...

GaussDB Kernel: Configuring the Validity Period of User Roles

During role creation, the keyword VALID BEGIN is used to set the role validity start time and VALID UNTIL to set the end time. If these two keywords are not set, roles are permanently valid. The role expiration time on each node in the GaussDB Kernel cluster depends on the OS clock on each node...

GaussDB Kernel: Enabling the Auditing of Database Locking and Unlocking

The parameter audituserlocked specifies whether to audit the locking and unlocking of database users. After this parameter is set to on, the locking status of database accounts is traced. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources,...

GaussDB Kernel: Resource Labels

You can add a resource label to a group of database resources to control them, improving resource management efficiency. Therefore, you are advised to enable enablesecuritypolicy. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...

GaussDB Kernel: Controlling the Permission to Execute the SECURITY DEFINER Function

Because the SECURITY DEFINER function is executed with the privileges of the user that created it, ensure that this function is not misused. For security purposes, set searchpath to exclude any schemas writable by untrusted users. This prevents malicious users from creating objects that mask...