Teradata Database. Security Administration

Transcription

1 Teradata Database Security Administration Release 13.0 B A November 2009

2 The product or products described in this book are licensed products of Teradata Corporation or its affiliates. Teradata, BYNET, DBC/1012, DecisionCast, DecisionFlow, DecisionPoint, Eye logo design, InfoWise, Meta Warehouse, MyCommerce, SeeChain, SeeCommerce, SeeRisk, Teradata Decision Experts, Teradata Source Experts, WebAnalyst, and You ve Never Seen Your Business Like This Before are trademarks or registered trademarks of Teradata Corporation or its affiliates. Adaptec and SCSISelect are trademarks or registered trademarks of Adaptec, Inc. AMD Opteron and Opteron are trademarks of Advanced Micro Devices, Inc. BakBone and NetVault are trademarks or registered trademarks of BakBone Software, Inc. EMC, PowerPath, SRDF, and Symmetrix are registered trademarks of EMC Corporation. GoldenGate is a trademark of GoldenGate Software, Inc. Hewlett-Packard and HP are registered trademarks of Hewlett-Packard Company. Intel, Pentium, and XEON are registered trademarks of Intel Corporation. IBM, CICS, RACF, Tivoli, and z/os are registered trademarks of International Business Machines Corporation. Linux is a registered trademark of Linus Torvalds. LSI and Engenio are registered trademarks of LSI Corporation. Microsoft, Active Directory, Windows, Windows NT, and Windows Server are registered trademarks of Microsoft Corporation in the United States and other countries. Novell and SUSE are registered trademarks of Novell, Inc., in the United States and other countries. QLogic and SANbox are trademarks or registered trademarks of QLogic Corporation. SAS and SAS/C are trademarks or registered trademarks of SAS Institute Inc. SPARC is a registered trademark of SPARC International, Inc. Sun Microsystems, Solaris, Sun, and Sun Java are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries. Symantec, NetBackup, and VERITAS are trademarks or registered trademarks of Symantec Corporation or its affiliates in the United States and other countries. Unicode is a collective membership mark and a service mark of Unicode, Inc. UNIX is a registered trademark of The Open Group in the United States and other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. THE INFORMATION CONTAINED IN THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. IN NO EVENT WILL TERADATA CORPORATION BE LIABLE FOR ANY INDIRECT, DIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING LOST PROFITS OR LOST SAVINGS, EVEN IF EXPRESSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The information contained in this document may contain references or cross-references to features, functions, products, or services that are not announced or available in your country. Such references do not imply that Teradata Corporation intends to announce such features, functions, products, or services in your country. Please consult your local Teradata Corporation representative for those features, functions, products, or services available in your country. Information contained in this document may contain technical inaccuracies or typographical errors. Information may be changed or updated without notice. Teradata Corporation may also make improvements or changes in the products or services described in this information at any time without notice. To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please teradata-books@lists.teradata.com Any comments or materials (collectively referred to as Feedback ) sent to Teradata Corporation will be deemed non-confidential. Teradata Corporation will have no obligation of any kind with respect to Feedback and will be free to use, reproduce, disclose, exhibit, display, transform, create derivative works of, and distribute the Feedback and derivative works thereof without limitation on a royalty-free basis. Further, Teradata Corporation will be free to use any ideas, concepts, know-how, or techniques contained in such Feedback for any purpose whatsoever, including developing, manufacturing, or marketing products or services incorporating Feedback. Copyright by Teradata Corporation. All Rights Reserved.

3 Preface Purpose The purpose of this book is to assist administrators in formulating, implementing, and auditing security policy for a Teradata Database system. Use it to: Understand the basic components of Teradata Database system security. Determine a security policy appropriate for your system and the business environment in which it operates. Prevent unauthorized users from gaining access to the system. Limit the access of legitimate Teradata Database users to only those resources (databases, tables, views, stored procedures, and macros) they are authorized to use. Monitor security events and take corrective action. Understand the structure and content of the Teradata Database security mechanisms that create session security context, and how to modify them. Enable linking of the directory users with Teradata Database users, external roles, and profiles. Audience This book is intended for those who plan and implement system security measures including: Security administrators Database administrators System administrators Others involved in data management and operations Supported Software Release This book supports Teradata Database Security Administration 3

4 Preface Changes to This Book Changes to This Book This book includes the following changes to support the current release: Release Teradata Database 13.0 November 2009 Teradata Database 13.0 April 2009 Teradata Database March 2008 Description Revised the following topics in Chapter 5. Tdpid LDAP Authcid Logons LDAP UPN Logons for Mapped Directory Users UPN Credential Format Restricting Logons by Host Group Revised Chapters 5 and 8 to describe the differences in configuration requirements for the SPNEGO mechanism for Teradata Database running on various operating systems. Added information on trusted sessions and proxy users to Chapters 2 and 3. Added information on SSL/TLS protection options to Chapters 4, 7, 8, 9, and Appendix F. Extensively revised the content of Chapter 7 to include more comprehensive coverage of access logging. Added information to Chapters 8 and 9 in support of new binding options. Added new entries to the list of certified directories to Chapter 9. Added new information on changing the TDGSS configuration for Windows.Net clients to Appendix C. Added new Appendix G: Setting up Kerberos Authentication on Unix Nodes. Added a new limit on use of IP-based access restrictions to Appendix I. Added information about the new SPNEGO mechanism, which supports logons through Windows.Net clients, to Chapters 5 and 8. Revised requirements for external authentication logons in Chapter 5 and added the GenerateCredentialsFromLogon property to Chapter 8. 4 Security Administration

5 Preface Additional Information Release Teradata Database 12.0 September 2007 Description Added information on support for kerberos authentication on Teradata Database systems running MP-RAS and SUSE Linux Enterprise Server to Chapter 2 and new Appendix F. Added information on password control enhancements to Chapter 2 and new Appendix E. Added information on internationalization to Chapter 2. Revised the section on automatically inherited rights in Chapter 3. Added set up instructions for specification of backup directory servers in Chapter 5. Extensively revised the material on IP logon restrictions in Chapter 6 and Appendix D. Added a warning about continued use of Append Domain Name in Chapter 2. Additional Information URL Description Use the Teradata Information Products Publishing Library site to: View or download a manual: 1 Under Online Publications, select General Search. 2 Enter your search criteria and click Search. Download a documentation CD-ROM: 1 Under Online Publications, select General Search. 2 In the Title or Keyword field, enter CD-ROM, and click Search. Order printed manuals: Under Print & CD Publications, select How to Order. The Teradata home page provides links to numerous sources of information about Teradata. Links include: Executive reports, case studies of customer experiences with Teradata, and thought leadership Technical information, solutions, and expert advice Press releases, mentions and media resources Teradata Customer Education designs, develops and delivers education that builds skills and capabilities for our customers, enabling them to maximize their Teradata investment. Security Administration 5

6 Preface References to Microsoft Windows and Linux To maintain the quality of our products and services, we would like your comments on the accuracy, clarity, organization, and value of this document. Please References to Microsoft Windows and Linux This book refers to Microsoft Windows and Linux. For Teradata Database 13.0, these references mean: Windows is Microsoft Windows Server bit. Linux is SUSE Linux Enterprise Server 9 and SUSE Linux Enterprise Server Security Administration

7 Table of Contents Preface Purpose Audience Supported Software Release Changes to This Book Additional Information References to Microsoft Windows and Linux Chapter 1: Introduction to Teradata Database System Security Teradata Database Security Principles Security Controls Controlling Physical Access Controlling Database Access Transmitting Secure Logons and Data Monitoring Database Activity Determining Security Requirements Business Value of Security Identifying Users and Their Needs Common User Groups Determining the Required Level of Security Minimal Security Moderate Security High Security Advantages and Disadvantages of Security Levels Formulating Security Policy Site-specific Teradata Database Security Policy Re-evaluating Security Policy Security Administration Duties of the Security Administrator Security Administration 7

8 Table of Contents Chapter 2: Creating Users and Defining Access Privileges...31 Users and Databases System Generated Users Guidelines for Creating Users Administrative Users Security Administrator Responsibilities Creating the Security Administrator User Database Administrator User Controlling Access to the Operating System Controlling Access to Teradata Dynamic Workload Manager Database Users Directory Managed Users Proxy Users Database Privileges Ownership Privileges Giving Ownership Related Topics Explicit Privileges Granting and Revoking Explicit Privileges Forms of the GRANT and REVOKE Statements Revoking Privileges from PUBLIC or ALL DBC Automatic Privileges User DBC Automatic Privileges Creator/Modifier Automatic Privileges Optional Methods for Limiting Database Access Views Macros Stored Procedures Related Topics Chapter 3: User Identification and Authentication User Identification Teradata Database Authentication External Authentication System Requirements for External Authentication Other Setup Options for External Authentication External Authentication with Delegated Credentials External Authentication for Channel-Attached Clients Security Administration

9 Table of Contents Accessing the Database Through a Middle-tier Application Establishing Trusted Sessions Granting Privileges to Establish and Use Trusted Sessions Security Considerations for Trusted Sessions Chapter 4: Protection Logon Encryption Password Encryption SASL Protection for Systems Using DIGEST-MD5 Binds SSL/TLS Protection for Systems Using Simple Binds Data Encryption Data Integrity Related Topics BAR Encryption Chapter 5: Logon Requirements and Controls Logon Elements Security Mechanism Database User Names Directory User Names Domain User Names Domain/Realm Appended Domain Name Passwords Tdpid Account String Using UTF-16 Characters in the Logon String Network Logon Formats Logon Requirements Determined by Authentication Type Logon Syntax Command Line Logons Logons Using Teradata Database Authentication Logons Using External Authentication Single Sign-on LDAP Logons LDAP Authcid Logons LDAP UPN Logons for Mapped Directory Users UPN Credential Format Security Administration 9

10 Table of Contents Common Errors with LDAP UPN Logons Sign-on As Explanation of Example Explanation of Example Common Errors with UPN Logons GUI Logons Logons Through Teradata Query Director Logons from Channel-Attached Systems Logons from Teradata Database Nodes Replication Logons Encryption of Replication Sessions Logons from Fully Managed.Net Clients Logon Errors Logon Error Handling Options Logon Controls Granting Logons Revoking Logons Precedence of Clauses Restricting Logons by Host Group Restricting Logons by IP Address Chapter 6: Creating and Managing Passwords Creating Passwords Related Topics Password Format Requirements Forgotten Passwords and Password Lockouts Tracking Changes to Passwords Password Control Options Controlling Passwords With Multibyte Characters Password Controls Located in DBC.SysSecDefaults Viewing Current Password Control Settings Using UPDATE to Manage Global Password Controls in DBC.SysSecDefault Using CREATE or MODIFY PROFILE to Password Controls for Specific Users Comparing Methods of Password Control Management Setting Password Controls ExpirePassword MaxLogonAttempts PasswordReuse LockedUserExpire (Password Lockout Time) Security Administration

11 Table of Contents PasswordMinChar PasswordMaxChar PasswordDigits PasswordSpecChar PasswordRestrictWords Error Messages Chapter 7: Monitoring Database Activity Monitoring Options and Objectives Access Logging of Database Users Default Logging Requirements for Using BEGIN/END LOGGING Statements Using BEGIN LOGGING to Enable Logging Functions General Rules for Using DDL Statements in Access Logging DBC.AccLogRuleTbl Entries DBC.AccLogTbl Entries Database Level Logging Table Level Logging Using BEGIN LOGGING With GRANT Logging MODIFY Statements BEGIN/END Logging Errors Disabling Access Logging with the END LOGGING Statement Access Logging of Directory Users Setting up the Gateway to Identify Directory Users in Access Logs Access Logging of Proxy Users Monitoring Security Related Tables and Views Viewing Log Entries Deleting Aged Log Entries Querying Systems Views MONITOR Related Queries Querying Session-Related Views Chapter 8: TDGSS Administration TDGSS Standards TDGSS Installation and Maintenance TDGSS for Channel-Attached Clients Versions and Version Switching Security Administration 11

12 Table of Contents Locating TDGSS Files TDGSS File Contents TDGSS Site File TDGSS File Maintenance Tools tdgsspkgrm tdgssversion TDGSS Configuration Files C/C++ and Java Application Sharing of TDGSS Configuration Files Setting the Java Application Classpath Using the Jar Update Command TDGSS Security Mechanisms Mechanism Selection Default Mechanism Mechanism Handling Mechanism Configurations TD2 Mechanism KRB5 Mechanism NTLM Mechanism LDAP Mechanism SPNEGO Mechanism Mechanism Properties Special Handling for New Properties Basic Functional Properties AuthenticationSupported AuthorizationSupported GenerateCredentialFromLogon SingleSignOnSupported Mechanism Status Properties DefaultMechanism MechanismEnabled MechanismRank Operational Properties DelegateCredentials MutualAuthentication ReplayDetection OutOfSequenceDetection ConfidentialityDesired IntegrityDesired AnonymousAuthentication DesiredContextTime DesiredCredentialTime CredentialUsage Security Administration

13 Table of Contents Directory User Authentication Properties LdapServerName Set up for LDAP Server Failover Protection LdapServerPort LdapServerRealm LdapSystemFQDN LdapBaseFQDN LdapGroupBaseFQDN LdapUserBaseFQDN LdapClientDebug LdapClientDeref LdapClientRebindAuth LDAP Binding Properties LdapClientMechanism LdapServiceBindRequired LdapServiceFQDN LdapServicePassword LDAP Protection Properties SSL/TLS Protection Avoiding Conflicts with OpenLDAP Tunables LdapClientTlsCACert LdapClientTlsCACertDir LdapClientTlsCert LdapClientTlsCipherSuite LdapClientTlsCRLCheck LdapClientTlsKey LdapClientTlsRandFile LdapClientTlsReqCert LdapClientUseTLS SASL Protection LdapClientSASLSecProps Confidentiality Properties VerifyDHKey DHKeyPand DHKeyG Changing the TDGSS Configuration Differences in Function for Client and Server Configuration Files General Rules for Editing Adding New Mechanisms or Properties to the User Configuration File Effects of Upgrade and Migration on TDGSS Configuration Changes Making Changes to the User Configuration Files Planning a Configuration Change Security Administration 13

14 Table of Contents Chapter 9: Directory Management of Database Users Supported Directories LDAP Binding Options Directory User Binding Options Service Binds Directory User Identification Options Identity Mapping Configuring an Identity Map Identity Searches Using <IdentityMap> and <IdentitySearch> in Combination Using <IdentityMap> and <IdentitySearch> with DIGEST-MD Directory User Management Options Option 1: Authentication Only--No Directory Schema Changes Option 2: Directory Authorization of Database Users Related Topics Directory User Characteristics Characteristics of Unmapped Directory Users Characteristics of Directory Users Mapped to Permanent Users Ownership of Database Objects Created by Directory Users Roles and Profiles for Directory Users Database Administration of External Roles Directory Administration of External Roles Session Role Hierarchy and Role Switching Effects of Drop External Role on Directory User Roles Effects of Changing Directory Role Assignments Profiles for Directory Users Related Topics Access Logging of Directory Users Configuring a Directory to Manage Database Users Directory Schema Overview Teradata Schema Extensions Attribute Usage Requirements Special Objects and Attributes Required for Active Directory and ADAM System Evaluation Optimization of Directory Searches Appendix A: System Level Security Maintaining Physical Security Security Administration

15 Table of Contents Setting Physical Security Policy Enforcing Security Policy Controlling Access to Dump Files Controlling Access to the Operating System Controlling Access to Outside Devices Appendix B: Running a Secure Teradata Database Securing a System to the Common Criteria Evaluated Configuration Common Criteria Level Security Procedure Avoiding Potential Security Hazards Appendix C: Changing the TDGSS Configuration Using dumpcfg to Check the Current TDGSS Configuration Changing the TDGSS Configuration on SUSE Linux Enterprise Server Nodes Changing the TDGSS Configuration on MP-RAS Nodes Changing the TDGSS Configuration on Windows Nodes tdgss Configuration Errors Making TDGSS Configuration Changes on Teradata Clients Changing the TDGSS Configuration on Windows Clients Changing the TDGSS Configuration on Windows.Net Clients Changing the TDGSS Configuration on Linux Clients Changing the TDGSS Configuration on non-linux UNIX Clients Reversion Procedure Appendix D: System Evaluation Tasks for Directory Integration Checking the Network From a Teradata Client From Teradata Database Server Nodes Testing the Directory Server The RootDSE Object Authenticating a Real User Common Errors with Active Directory and ADAM DNS Naming Issue Security Administration 15

16 Table of Contents Server Down: As Seen from Windows Server Down: As Seen from MP-RAS Invalid User, Password, or Realm Common Errors with Sun Java Directory Server Server Down Bad Canonicalization Bad User Bad Password Appendix E: Configuring a Directory to Manage Teradata Database Users Installing Teradata Schema Extensions in a Supported Directory Schema Installation Options Installation on Active Directory or ADAM from Teradata Database on Windows Installation on Active Directory or ADAM from Teradata Database on MP-RAS or SUSE Linux Enterprise Server Installation on Sun Java System Directory Server Installation on Novell edirectory Directory Information Tree Teradata Database Objects in the DIT Hierarchy Populating the Directory Information Tree tdatrootnode Object tdatsystem Object Creating Containers and Inserting Objects Naming Conventions Entering Container and Object Information in the Directory Users Roles Profiles IP Filters Mapping Directory Users to Teradata Database Objects Mapping Directory Users to Database Users Mapping Directory Users to Database External Roles Mapping Directory Users to Database Profiles Mapping IPFilters to Database Users Testing Mapped Directory Users Using BTEQ to Verify Directory User Mapping tdsbind Running tdsbind Output from tdsbind Security Administration

17 Table of Contents Explanation of Example Explanation of Example Diagnosing Logon Failure Due to Incorrect Realm Information tdsbind Error Output ldapsearch Running ldapsearch Usage Notes for ldapsearch Finding User Information with ldapsearch Determining the schemanamingcontext Value Other LDAP Tools Appendix F: Setting Up SSL/TLS Options Requirements Supported Versions Installation of OpenSSL Basic SSL/TLS Support Required to Support Advanced Options Configuring Basic SSL/TLS Functions SSL Protection TLS Protection Preparing to Configure Advanced Options Directory Server Certificate Requirements Authentication of the Directory Server by Teradata Database Verifying the Directory Server Certificate Chain Step 1: Obtaining the Directory Server Certificate Chain Step 2: Creating the CA Certificate Hashes Step 3: Configuring TDGSS and TeraGSS Step 4: Testing the Connection Mutual Authentication of the Directory Server and Teradata Database Installing Certificates and Private Keys Installing the Private Key Installing the Certificate Repeat the Installations for the Entire Database Updating the TDGSS or TeraGSS Configuration Troubleshooting Hostname Does Not Match CN in Peer Certificate SSL: Certificate Verify Failure TLS: Self-signed Certificate Offered or Is Part of the Certificate Chain TLS: Unable to Get Local Issuer Certificate Security Administration 17

18 Table of Contents Appendix G: Setting up Kerberos Authentication on Unix Nodes Active Directory Setup Task 1: Create a Computer Component for Each Teradata Database Node Task 2: Add Unix Nodes to the Domain Name System (DNS) Task 3: Create an Active Directory User for Each Unix Node Task 4: Determine the Service Principal Name Task 5: Run ktpass to Create the Kerberos Keys Task 6: Move the Kerberos Keys to the Teradata Database System Teradata Database Node Setup Task 7: Install Kerberos on All Teradata Database Nodes Task 8: Setup krb5.conf Kerberos Configuration File Task 9: Verify That a Unix Node Can Find the Name Server Task 10: Install the Kerberos Keys Task 11: Synchronize Time Between the Domain and the Nodes Task 12: Check the Kerberos Synchronization Setup Appendix H: Controlling User Access by IP Address Principals of IP AccessRestriction Usage Constraints Ensuring Security Creating an XML IP Restriction Document Saving the Completed XML IP Restriction Document Designing IP Restrictions IP Restriction Concepts Element Descriptions IP Filters Effects of Filter Type on allow and deny Elements Addresses and Mask Structure How Masks Affect Filters Important Masking Properties Forms of Interaction Between Primary and Secondary Masked IPs Permissive Filters Restrictive Filters Applying a Filter to a User Application of IP Restrictions Applying a Filter to All Users Directory Implementation of IP Restrictions Security Administration

19 Table of Contents Loading Directory Schema Extensions for IP Restriction of Directory Users Creating IP Restriction Schema Objects in the Directory Standard Teradata Database Schema Objects IP Filter Schema Objects Mapping IP Filters to Database Users Data Conversion Utilities ipxml2bin ipdir2bin Appendix I: Password Restricted Words Default Restricted Words Frequently Used Words Frequently Used Names Glossary Index Security Administration 19

20 Table of Contents 20 Security Administration

21 CHAPTER 1 Introduction to Teradata Database System Security The information in this book is intended help security administrators to understand and perform the following security functions: Authenticate users at logon to prevent outsiders from gaining access to the system. Manage logon and password controls to ensure secure authentication. Authorize users to access only those objects and resources for which they have permission. Employ and modify security mechanisms to facilitate the user authentication and authorization strategy. Manage Teradata Database users externally using a directory. Enable encryption to secure message transmissions between client and server. Monitor security events and, where necessary, take corrective action. Create a site security policy based on site requirements, Teradata Database capabilities, and the chosen implementation strategy. Teradata Database Security Principles Teradata Database security is based on the following principles. Security Principle Database User Database Privileges Logon Description A database user is an individual defined in the database and identified by a username and password. The user definition also includes provisions to define the space available to the user for creating database objects, the accounts to which the user can charge jobs, and membership in a profile, which can determine a number of system parameters that apply to the user. A user can access and interact with the database only as defined in the database privileges assigned to the user. These privileges can be granted explicitly to a user, or to a role of which the user is a member. Users acquire some privileges implicitly or automatically as part of other privileges, or as a result of creating database objects. Users accessing Teradata Database must logon with a username and password. They may choose to logon to the database directly or through a middle-tier application. The logon also defines the security mechanism that will be used to authenticate the user. Security Administration 21

22 Chapter 1: Introduction to Teradata Database System Security Security Controls Security Principle Authentication Authorization Security Mechanisms Access Logging Protection Description At logon, the username and password are compared with a list valid users to verify that the user is authentic. Authentication can be performed by Teradata Database or by an external agent, such as a directory. Users are authorized database privileges based on: Privileges explicitly or implicitly granted in the database. Mapping of directory-based users to database users, roles, and profiles. Selectable database objects that define how the user will be authenticated, and in some cases, authorized. Logons use the mechanism specified in the logon string, or if no mechanism is specified, the current default mechanism. The database can be configured to log all user attempts to access the database, as well as the database objects that are accessed. Network transmissions between the database and its clients are protected as follows: By default, logon strings are encrypted. Network traffic between Teradata Database and its clients can be optionally encrypted. Additional protection is available for directory user logons, including obfuscation of the logon string and peer authentication of the directory and database. Security Controls You must define and implement effective security controls to establish and maintain optimal database security. You can control database security in the following ways. Restrict physical access to database system hardware. Use logon controls to limit access to the database. Define database privileges for each user to restrict activity within the database. Secure data transmissions to and from the database using encryption. Monitor user activity to detect security threats and violations. The following sections provide an overview of how to exercise these controls. Controlling Physical Access The most basic level of security is to limit access by unauthorized persons to the physical components of the Teradata Database system. These components include processor nodes, disk storage units, and the Administration Workstation (AWS). Controlling access to physical components involves the following elements: Protect the system against deliberate damage by locating it in a secure room. 22 Security Administration