SharePlex provides a number of security features that help protect replicated data on the local system and during transfer across a network. This chapter provides guidelines for the configuration and use of these features.
Note: When replicating data from PostgreSQL to PostgreSQL, SharePlex supports only Secure Data with SSL/TLS and Encrypt Data between Export and Import security features .
SharePlex provides a feature to enable SSL/TLS connections for all network traffic. This will encrypt data on the network between SharePlex instances and between SharePlex and the command line interface.
If SSL/TLS is enabled, SharePlex will only accept SSL/TLS connections. For all SharePlex instances that replicate to each other, either all must have SSL/TLS enabled or all must have SSL/TLS disabled. The SSL/TLS configuration includes a network password. This password must be the same across all of your SharePlex instances.
NOTE: For TLS connections, SharePlex supports TLS 1.2 (or later).
To change the SSL/TLS configuration:
Use the sp_security utility to enable, disable or view the SSL/TLS settings for SharePlex network communication.
IMPORTANT! SSL/TLS must be either enabled with a common network password or disabled on all SharePlex installations.
To enable SSL/TLS:
Run sp_security --setup, select the SSL/TLS option, and then enter a network password.
% sp_security --setup Security Setup Wizard --------------------- This wizard will walk you through setting up the SharePlex network security. Setup configuration for '/home/shareplex/var110/' and Port 2100 [N]: Y Choose your network security model. Please note the following: * Cop must be down when the security model is changed, or when the network password is changed * The same model must be used among all SharePlex nodes replicating to each other * For security model [1], the same network password must be set on all SharePlex nodes replicating to each other [1] Use basic SSL/TLS connections [2] Use non-SSL/TLS connections (default prior to SharePlex 9.1.3) Security model: 1 Please enter a network password that will be used for authentication among the SharePlex nodes. All SharePlex nodes that replicate data to each other must have the same network password. Network password: Please re-enter the network password Network password: Security settings: Configuration for '/home/shareplex/var110/' and Port 2100: Security model : SSL/TLS Network password : stored for unattended startup SSL key file password : stored for unattended startup SSL key file : key.pem SSL cert file : cert.pem Setup complete!
IMPORTANT! SSL/TLS must be either enabled with a common network password or disabled on all SharePlex installations.
To disable SSL/TLS:
Run “sp_security --setup” and select non-SSL/TLS connections.
% sp_security --setup Security Setup Wizard --------------------- This wizard will walk you through setting up the SharePlex network security. Setup configuration for '/home/shareplex/var110/' and Port 2100 [N]: Y Choose your network security model. Please note the following: * Cop must be down when the security model is changed, or when the network password is changed * The same model must be used among all SharePlex nodes replicating to each other * For security model [1], the same network password must be set on all SharePlex nodes replicating to each other [1] Use basic SSL/TLS connections [2] Use non-SSL/TLS connections (default prior to SharePlex 9.1.3) Security model: 2 Security settings: Configuration for '/home/shareplex/var110/' and Port 2100: Security model : Un-encrypted Setup complete!
To view the current SSL/TLS configuration:
Run “sp_security --show”.
% sp_security --show Security settings: Configuration for '/home/shareplex/var110/' and Port 210: Security model : Un-encrypted
SharePlex provides host authorization security that verifies whether or not SharePlex processes on specific remote systems are authorized to connect to the local system for service and command requests. To implement host authorization, you create an ASCII text file named auth_hosts in the data sub-directory of the SharePlex variable-data directory and then populate it with the names of systems being granted connection permission.
To configure the auth_hosts file:
Note: Begin comment lines with a pound character (#).
On the next non-commented line, enter one of the following:
| Value | Description |
|---|---|
| all | Grants connection authorization to processes on all remote systems. |
| hostname | Grants connection authorization to the specified host. Enter the fully qualified machine name, for example remotehost.mycorp.com. Specify as many host names as needed, each on its own line. |
Note the name of the local host is on the first non-commented line.
|
#Comment: first line is local host name. Localhost.mycorp.com #Comment: remaining lines are remote hosts. remotehost.mycorp.com remotehost2.mycorp.com remotehost3.mycorp.com |
SharePlex uses the SSH® Secure ShellTM utility to provide encryption for network services such as secure remote login and other services over an insecure network.
To set up SharePlex to use SSH:
On the source system, issue the following command from the command prompt. This command connects to the target system to set up the tunnel.
$ ssh -L source_port:target_host:target_port userid@target_host -N -f
where:
Refer to your SSH documentation for more information about these commands.
(If using multiple SharePlex instances) On the source system, export the correct variable-data directory for the instance of sp_cop for which you are setting up SSH.
ksh shell:
export SP_SYS_VARDIR=/full_path_of_variable-data_directory
csh shell:
setenv SP_SYS_VARDIR=/full_path_of_variable-data_directory
In sp_ctrl, set the SP_XPT_USE_LOCALHOST parameter in one of the following ways.
sp_ctrl> set param SP_XPT_USE_LOCALHOST 1
sp_ctrl> set param SP_XPT_USE_LOCALHOST to host 1
where: host is the name of the target system that will use the tunnel.
In sp_ctrl, use the list param command with the modified option to verify the parameter setting. If the setting is correct, you can activate a configuration at this point.
sp_ctrl> list param modified
If there is an active configuration, stop and then start sp_cop to make the new parameter setting active.
To stop sp_cop:
sp_ctrl> shutdown /productdir/bin/sp_cop &
To start sp_cop:
$ /productdir/bin/sp_cop &
© ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center
