/7.1/security/Recent content in Security on Kinetica DocsHugo -- gohugo.ioen/7.1/security/auditing/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/auditing/Kinetica can be configured to print audit information to a log for security or debugging purposes. The audit configuration settings can be found in the Auditing section of the gpudb.conf file (located in the /opt/gpudb/core/etc directory). The enable_audit setting must be enabled for the other settings to work. Any of these settings can be altered at runtime using /alter/system/properties to assist with debugging unless lock_audit is set to true. Below is a list of the settings and what they do:/7.1/security/shared/ex_auth_config/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ex_auth_config/External authentication data store integration with Kinetica is accomplished through an Apache HTTPD proxy. This proxy comes packaged with Kinetica and can be found in /opt/gpudb/httpd. Since this portion is controlled by Apache HTTP not Kinetica, see the Apache documentation for further details. External authentication can be configured for Kinetica with or without SSL. Kinetica currently supports the following external authentication sources: LDAP Microsoft Active Directory Kerberos Important See Obfuscating Plain-Text Passwords for an example of obfuscating the plain-text LDAP/AD password in the HTTPD configuration file./7.1/security/shared/ssl/httpd_data_config/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ssl/httpd_data_config/Navigate to /opt/gpudb/httpd/conf/data.conf and uncomment the following settings, ensuring you replace the SSLCertificateFile and SSLCertificateKeyFile setting values with the proper file paths. Read the Apache HTTPD SSL Docs for more information SSLEngine On ... SSLCertificateFile </path/to/cert> SSLCertificateKeyFile </path/to/key> SSLProxyEngine On RequestHeader set X-Forwarded-Proto "https" Important The following settings are optional but provide greater security. Depending on what version of OpenSSL is installed on the system, the TLS version should be updated./7.1/security/shared/ssl/httpd_noauth_config/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ssl/httpd_noauth_config/Navigate to /opt/gpudb/httpd/conf/noauth.conf and uncomment the following settings, ensuring you replace the SSLCertificateFile and SSLCertificateKeyFile setting values with the proper file paths. Read the Apache HTTPD SSL Docs for more information SSLEngine On ... SSLCertificateFile </path/to/cert> SSLCertificateKeyFile </path/to/key> SSLProxyEngine On RequestHeader set X-Forwarded-Proto "https" Important The following settings are optional but provide greater security. Depending on what version of OpenSSL is installed on the system, the TLS version should be updated./7.1/security/shared/ssl/comp_config/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ssl/comp_config/Reveal Navigate to /opt/gpudb/connectors/reveal/etc/default.json and update the url setting: "gadmin": { "url": "https://localhost:8443/gadmin" }, GAdmin Navigate to the /opt/gpudb/tomcat/webapps/gadmin/js/settings.js file and update the REVEAL_PORT variable to the secured Reveal port (default 8444): var REVEAL_PORT = '8444'; Navigate to the /opt/gpudb/tomcat/webapps/gadmin/WEB-INF/classes/gaia.properties file and update the following settings to https, ensuring the host is correct for your setup gpudb_ext_url = https://<hostname>:8082/gpudb-0 ... gpudb_ext_hm_url = https://<hostname>:8082/gpudb-host-manager In the /opt/gpudb/tomcat/conf/catalina.properties file at the bottom:/7.1/security/sec_hardening/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/sec_hardening/Overview Utilities Example Overview Some deployments of Kinetica may require that plain-text passwords in configuration files be obfuscated, for security reasons. A method for doing so has been made available via a set of scripts. The encryption key generated for performing the obfuscation will be available to the root and gpudb users to encrypt/decrypt passwords, as necessary. Utilities Three utilities are provided to enable obfuscation of plain-text passwords in configuration files./7.1/security/reveal/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/reveal/Overview Reveal manages its own application database. In addition to storing data about dashboards and slices, it also manages users, roles, and permissions for accessing those entities specific to Reveal. As a result, Reveal user management is distinct from Kinetica user management such that operations on either system will not automatically sync with the other. Authentication Kinetica can run with or without required client authentication; for details, see Security Configuration./7.1/security/sec_concepts/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/sec_concepts/Overview Users Internal Users External Users Default Users User Endpoints Roles Default Roles Role Endpoints Permissions System Permissions Schema Permissions Table Permissions Row-Level Security Column-Level Security Column-Level Security Functions Credential Permissions Data Source Permissions Data Sink Permissions Function Permissions Graph Permissions KiFS Permissions Procedure Permissions Table Monitor (SQL Stream) Permissions Permission Endpoints Overview Kinetica provides secured access to data and data services by means of role-based access control (RBAC). Permissions are assigned at the table level, schema level, or globally, and can be assigned either directly or grouped into roles for assignment./7.1/security/sec_configuration/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/sec_configuration/Kinetica comes equipped with several configuration options and some software to help secure and protect your data. Currently, there are several paths to securing the database in some fashion: HTTPD -- Hides internal ports HTTPD with SSL -- Hides internal ports and secures connections HTTPD with External Authentication -- Hides internal ports and enables & configures external authentication HTTPD with SSL and External Authentication -- Hides internal ports, secures connections, and enables & configures external authentication Note/7.1/security/sec_usage/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/sec_usage/The examples below use the native API to manage users, roles, and permissions. Generally, the API is symmetric across the endpoint calls, so similarly named calls between API languages should have the same function. The following security-related topics will be covered: Authentication User Management Creating Users Deleting Users Role Management Creating Roles Assigning Roles Unassigning Roles Deleting Roles Permission Management Managing System Permissions Managing Table Permissions Managing Table Permissions at the Row Level Managing Table Permissions at the Column Level Managing Credential Permissions Managing Data Source Permissions Managing Data Sink Permissions Managing Graph Permissions Managing Directory Permissions Managing Procedure Permissions Managing Table Monitor Permissions Security Information Retrieval Basic Security Information Table-Level Security Information External (LDAP) Users Global Session Timeout Configuration Authentication Connecting & authenticating to a Kinetica instance generally requires four parameters:/7.1/security/shared/user_management/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/user_management/Once Kinetica is connected to an external authentication source, the external users can be used for all Kinetica administration. First, a user with administrative permissions that can be tied to an external user will need to be created within Kinetica: Log into Kinetica Administration Application (GAdmin) with an internal Kinetica administration account From the Security menu, select Users Click the New button For Authentication, select External Enter an external user's username, preceded by @./7.1/security/shared/non-ssl/ex_auth_ver/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/non-ssl/ex_auth_ver/Restart host manager and the database using: service gpudb_host_manager start service gpudb start Run a Host Manager status check: service gpudb_host_manager status Verify the output shows HTTPD is running: ... Httpd : Running (14250 14277 14278 14279 14280 14282) ... Ensure HTTPD is working: curl <hostname>:8082 Ensure Kinetica is running properly: curl <hostname>:8082/gpudb-0 Verify both internal and external users can login to GAdmin at http://<hostname>:8080 Verify both internal and external users can login to Reveal at http://<hostname>:8088/7.1/security/shared/non-ssl/verification/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/non-ssl/verification/ Restart host manager and the database using: service gpudb_host_manager start service gpudb start Run a Host Manager status check: service gpudb_host_manager status Verify the output shows HTTPD is running: ... Httpd : Running (14250 14277 14278 14279 14280 14282) ... Ensure HTTPD is working: curl <hostname>:8082 Ensure Kinetica is running properly: curl <hostname>:8082/gpudb-0/7.1/security/shared/ssl/ex_auth_ver/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ssl/ex_auth_ver/Restart host manager and the database using: service gpudb_host_manager start service gpudb start Run a Host Manager status check: service gpudb_host_manager status Verify the output shows HTTPD is running: ... Httpd : Running (14250 14277 14278 14279 14280 14282) ... Ensure Kinetica is running properly: curl -k https://<hostname>:8082/gpudb-0 Verify the output shows Kinetica is running: Kinetica is running! Verify both internal and external users can login to GAdmin at https://<hostname>:8443/7.1/security/shared/ssl/verification/Mon, 01 Jan 0001 00:00:00 +0000/7.1/security/shared/ssl/verification/Restart host manager and the database using: service gpudb_host_manager start service gpudb start Run a Host Manager status check: service gpudb_host_manager status Verify the output shows HTTPD is running: ... Httpd : Running (14250 14277 14278 14279 14280 14282) ... Ensure Kinetica is running properly: curl -k https://<hostname>:8082/gpudb-0 Verify the output shows Kinetica is running: Kinetica is running! Login to GAdmin at https://<hostname>:8443 Login to Reveal at https://<hostname>:8444 Login to Workbench at https://<hostname>:8445