openGauss: Restricting the Permission for the Database Home Directory

$GAUSSHOME is the installation directory of openGauss. To prevent the installation package from being tampered or damaged and protect customer network from security threats, this directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone Networks GmbH Some text...

openGauss: Restricting the Permission for the pg_hba.conf File

The configuration file pghba.conf stores the configuration information about database connections. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C...

openGauss: Ensuring the Existence of the server.crt File

The best solution to prevent TCP server spoofing is to use the SSL certificate and ensure that the server certificate is verified on the client. Therefore, the server must be configured to use only the hostssl connection, and the server.key key and server.crt certificate files using the SSL must ...

openGauss: Authentication Parameters

Set login parameters for scanning openGauss database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openGauss: Configuring the Automatic Account Unlocking Time

Configure the automatic account unlocking time for locked abnormal accounts. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

openGauss: Configuring the Number of Connections to a Role

The number of connections to a role must be limited. If rolconnlimit is set to -1, the number of concurrent connections is unlimited. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

openGauss: Deleting the Default User Name

You are advised not to use a well-known user name, for example, postgres. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

openGauss: Configure an Audit Priority Policy

Configures the policy for determining whether audit logs are preferentially stored by space or time. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

openGauss: Setting the Number of Connections Used by System Administrators

sysadminreservedconnections indicates the minimum number of connections reserved for the openGauss system administrator. The value of this parameter must be less than that of maxconnections. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

openGauss: Enabling the Log Collector

The parameter loggingcollector specifies whether the log collector is enabled. The log collection process captures log messages sent to stderr or csvlog and writes them to log files, avoiding data loss during Syslog logging. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be...

openGauss: Setting database for host Entries in the pg_hba.conf File

If database is set to all for host entries, connected users are allowed to access any database. You are advised to set database for host entries to the database to be Connected. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...

openGauss: Controlling the Permission to Execute the SECURITY INVOKER Function

The SECURITY INVOKER function is executed with the permissions of the invoker. Before invoking such a function not created by yourself, check the function content to prevent the function creator from performing unauthorized operations with your permissions. Copyright C 2020 Greenbone Networks Gmb...

openGauss: Checking the CREATEROLE Permission

Only the role with the CREATEROLE permission can create, modify, or delete other roles. Such a role can also grant permissions to or revoke permissions of other roles. To avoid arbitrary permission granting, delete roles that do not require the CREATEROLE permission. Copyright C 2020 Greenbone...

openGauss: Prohibiting host Entries (Except Intra-openGauss Nodes) from Using Trust Authentication in the pg_hba.conf File

openGauss nodes are deployed on the secure intranet. Only the communications between intra-openGauss nodes are allowed to use trust authentication. Trust authentication assumes that all users who can connect to the openGauss server nodes can access the database. This method is applied only when a...

openGauss: Deleting hostnossl Entries from the pg_hba.conf File

The connections specified by the hostnossl entries are not encrypted using SSL. Considering security, you are advised to use the SSL connection. SSL can be used for connections between the CN and external nodes but not for connections between internal nodes. Copyright C 2020 Greenbone Networks Gm...

openGauss: PUBLIC Role Should Not Have Any Permissions on the pg_catalog.pg_authid Table

The pgcatalog.pgauthid table contains all system roles. To protect them from being arbitrarily changed, the PUBLIC role is not allowed to have any permissions on this table. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...

openGauss: Configuring the Password Complexity Check

For database security purposes, password complexity is checked during user creation and password changes. Passwords not meeting complexity requirements are not allowed in openGauss. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and a...

openGauss: Revoking the CREATE Permission from a User with the PUBLIC Role

A common user can create malicious functions with the same names as system functions if the user has the PUBLIC role. In this way, other users can call these malicious functions by mistake to compromise database security. If the PUBLIC role has the CREATE permission, any user having this role can...

openGauss: Enabling the Auditing of Permission Granting and Revoking

The parameter auditgrantrevoke specifies whether to audit the permissions granted to and revoked from database users. After this parameter is set to on, database account permissions are traced. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

openGauss: Setting Source IP Address for host Entries in the pg_hba.conf File

If source IP address is set to all or 0.0.0.0/0 for host entries, any IP addresses can access the database. You are advised to set source IP address for host entries to the IP address that needs to connect to the database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be...