Database Security Service. FAQs. Issue 19 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 19 Date HUAWEI TECHNOLOGIES CO., LTD.

2 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. i

3 Contents Contents 1 Function What Databases Does DBSS Support? Which Databases Does DBSS Protect? How Do I Protect My EIP Against DDoS Attacks? Why Cannot I View DBSS Instances Immediately After I Purchase a Set of DBSS Instances? What Key Fine-grained Functions Can Database Protection Provide? What Is the Configuration Process on HexaTier? Does Database Protection Require the root User Permission from the MySQL Database? Can I Import Logs Generated by Database Protection to My Log Analysis Platform? What Configurations Need to Be Performed on the Service Side to Use Database Protection? What Are the Differences Between Database Protection and SQL Injection Protection for WAF? Will My Raw Data in the Database Be Changed by the Dynamic Data Masking Function? Does Database Protection Have a Service Latency? What Should I Do If I Forget the Initial Login Password for HexaTier? What Is Database Audit? Which Scenarios Does Database Audit Apply to? What Specifications Does Database Audit Support? What Databases Does Database Audit Support? Which OSs Does Database Audit Support? Which Functions Will Database Audit Provide? Does Database Audit Support Bidirectional Audit? What Is the Process Name of the Database Audit Agent? Where Are the Logs of the Database Audit Agent Saved? How Long Are the Operation Logs of Database Audit Saved by Default? How Long Is the Audit Data of Database Audit Stored by Default? Can the Audit Logs of Database Audit Be Backed Up? Can the Operation Logs of Database Audit Be Migrated? How Long Do I Receive an Alarm When an Exception Occurs in Database Audit? Is the Total Number Of Alarms Every Day the Same as that of s? Regions Which Regions Is DBSS Available In? Restriction... 9 Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. ii

4 Contents 3.1 What Constraints Does HexaTier Have? What Browser Versions Does HexaTier Support? Operation How Do I Log In to HexaTier? How Do I Run the Agent Program? How Do I Uninstall the Agent Program? How Do I View the Status of the Agent Program? How Do I Check the Version of Database Audit? How Do I View All Alarms in Database Audit? Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. iii

5 1 Function 1 Function 1.1 What Databases Does DBSS Support? This section describes the database types and versions DBSS supports. Database protection supports the following database types: Microsoft SQL Server MySQL PostgreSQL DWS NOTE Database protection supports Distributed Database Middleware (DDM). However, only some functions of DDM are supported currently due to the defect of the DDM mechanism. Database audit supports the following database types: MySQL 5.0 MySQL 5.1 MySQL 5.5 MySQL 5.6 MySQL 5.7 MySQL Which Databases Does DBSS Protect? DBSS protects user-installed databases and RDS instances on ECSs within the same VPC and its subnets. Due to network restrictions, DBSS cannot protect user-installed databases and RDS instances on ECSs and BMSs if then are not in the same VPC and its subnets. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 1

6 1 Function 1.3 How Do I Protect My EIP Against DDoS Attacks? Advanced Anti-DDoS is a network security service that defends IP addresses against distributed denial of service (DDoS) attacks. You are advised to interconnect each of your EIP with Advanced Anti-DDoS. 1.4 Why Cannot I View DBSS Instances Immediately After I Purchase a Set of DBSS Instances? When you purchase a database protection or database audit instance, the system disk and network configuration of the virtual machine (VM) where the instance resides takes a little time. Therefore, you need to wait until the VM completes its configuration and then view the instance. 1.5 What Key Fine-grained Functions Can Database Protection Provide? This section describes key fine-grained functions provided by database protection. Database protection provides the following fine-grained functions: Table-specific access control by IP address, user, and application Column-level audit by IP address, user, and application Column-level dynamic data masking 1.6 What Is the Configuration Process on HexaTier? This section describes key configuration procedures of HexaTier, the database protection console. After logging in to HexaTier, you should configure your database protection instance for it to connect to, protect, and audit your database on HUAWEI CLOUD. Figure 1-1 illustrates the configuration process. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 2

7 1 Function Figure 1-1 Configuring HexaTier 1.7 Does Database Protection Require the root User Permission from the MySQL Database? No. Database protection only requires read and write permissions from your MySQL database. 1.8 Can I Import Logs Generated by Database Protection to My Log Analysis Platform? Yes. The logs can be archived to a remote log database. Then you can use your own platform to read logs from the database. 1.9 What Configurations Need to Be Performed on the Service Side to Use Database Protection? This section describes how to configure database protection on the service side. To use database protection, perform the following configurations on the service side: Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 3

8 1 Function 1. Configure proxy when you create a protected database on HexaTier. Ensure that the proxy status is Active. 2. Modify your database to point it to the proxy address and port configured on HexaTier What Are the Differences Between Database Protection and SQL Injection Protection for WAF? Web Application Firewall (WAF) uses a rule library to identify SQL injection attacks. Database protection, in comparison, uses a built-in database engine to cover all types of database statements. Compare with WAF, database protection is more accurate in identifying attacks Will My Raw Data in the Database Be Changed by the Dynamic Data Masking Function? No. Database protection changes the data returned by the database. It does not change the raw data in the database Does Database Protection Have a Service Latency? Typically, the service latency is shorter than 3 ms. The service latency may change in peak hours What Should I Do If I Forget the Initial Login Password for HexaTier? Contact the customer service What Is Database Audit? This section describes the concept of database audit. Database audit is deployed in a bypass disposition pattern. It records user access to the database in real time, generates fine-grained audit reports, sends real-time alarms for risky operations and attack behaviors. In addition, database audit generates compliance reports that meet data security standards (such as Sarbanes-Oxley) to locate internal violations and improper operations, thus ensuring data asset security Which Scenarios Does Database Audit Apply to? Database audit applies to enterprises or organizations that have high security requirements on data security. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 4

9 1 Function 1.16 What Specifications Does Database Audit Support? This section describes the database instance specifications database audit supports Database audit supports the following specifications: Basic: supports up to three database instances. Professional: supports up to six database instances. Advanced: supports up to 30 database instances What Databases Does Database Audit Support? This section describes the database types database audit supports. Database audit supports the following database types: MySQL 5.0 MySQL 5.1 MySQL 5.5 MySQL 5.6 MySQL 5.7 MySQL Which OSs Does Database Audit Support? Database audit supports databases or applications deployed on Linux Which Functions Will Database Audit Provide? This section describes the functions database audit will support in the future. The following advanced audit functions will be provided: Associated audit Compression protocol Vulnerability scan Vulnerability detection Data reduction detection Blocking sessions Audit log encryption Creating blacklist and whitelist based on self-learning and dynamic modeling Automatic identification of database types, versions, character sets, ports, and OSs Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 5

10 1 Function 1.20 Does Database Audit Support Bidirectional Audit? Yes. Bidirectional audit is used for database audit by default What Is the Process Name of the Database Audit Agent? This section describes the process name of the database audit agent. The process name of the agent is /opt/dbss_audit_agent/bin/audit_agent 1.22 Where Are the Logs of the Database Audit Agent Saved? This section describes the path for storing logs of the database audit agent. The path for saving agent logs is /opt/dbss_audit_agent/log/audit_agent.log How Long Are the Operation Logs of Database Audit Saved by Default? The operation logs of database audit are permanently saved How Long Is the Audit Data of Database Audit Stored by Default? Audit data is stored for at least 180 days Can the Audit Logs of Database Audit Be Backed Up? Database audit supports manual backup and automatic backup. Audit logs are backed up to OBS. Buckets are automatically created for you, and are charged by use Can the Operation Logs of Database Audit Be Migrated? No. Database audit does not support migrating database operation logs. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 6

11 1 Function 1.27 How Long Do I Receive an Alarm When an Exception Occurs in Database Audit? When database audit is running properly, the maximum latency from the time when an exception occurs to the time when you receive the notification is less than 5 minutes Is the Total Number Of Alarms Every Day the Same as that of s? This section describes the relationship between the number of alarms sent by database audit and the number of s received by users. Yes. One alarm message corresponds to one notification. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 7

12 2 Regions 2 Regions 2.1 Which Regions Is DBSS Available In? This section describes the regions DBSS supports. CN East-Shanghai2 CN South-Guangzhou CN North-Beijing1 Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 8

13 3 Restriction 3 Restriction 3.1 What Constraints Does HexaTier Have? This section describes restrictions using HexaTier. Pay attention to the following constraints when using HexaTier: If you choose RDS as the remote log database, you must change the value of database configuration parameter local_infile to ON (the default value is OFF). If you want to protect an RDS instance, you must change the value of database configuration parameter lower_case_table_names to 1 (the default value is 0). Advanced activity monitoring Chinese names of data tables are not supported. 3.2 What Browser Versions Does HexaTier Support? This section describes the browser versions supported by the HexaTier. Table 3-1 lists browsers supported by the HexaTier management system. Table 3-1 Supported browser versions Browser Version Google Chrome - Mozilla FireFox Internet Explorer 30.1 and later 11.0 and later Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 9

14 4 Operation 4 Operation 4.1 How Do I Log In to HexaTier? If an EIP has been associated with a database protection instance, two methods are available for going to the HexaTier login page: either directly from the database protection page or using an ECS in the VPC where the instance resides. If no EIP has been associated with the instance, one method is available: using an ECS in the VPC where the instance resides. Login to HexaTier from the DBSS Console Step 1 Log in to the management console. Step 2 Click in the upper left corner of the management console and select a region or project. Step 3 Step 4 Step 5 On the top of the console, click Service List and choose Security > Database Security Service. In the navigation tree on the left, choose > Database Protection. The Database Protection instances page is displayed. In the square of the desired set of DBSS instances, click Login to go to the HexaTier login page. Figure 4-1 shows an example. Figure 4-1 Logging in to HexaTier Step 6 Enter the login username (admin) and password. Then click Log In or press Enter, as shown in Figure 4-2. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 10

15 4 Operation Figure 4-2 Logging in to HexaTier ----End Using an ECS in the VPC Where the Instance Resides Step 1 Step 2 In the VPC where the instance you want to use to log in to HexaTier resides, check whether there are more ECSs. If yes, go to Step 2. If no, create an ECS in this VPC and go to Step 2. Use a browser in Table 4-1, enter the following address, and press Enter. The HexaTier login page is displayed. IP Address of an ECS:5000 If you fail to access port 5000, add Transmission Control Protocol based (TCP-based) access permissions on the port to the corresponding security group. For details, see the Virtual Private Cloud User Guide. Table 4-1 Supported browser versions Browser Version Google Chrome - Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 11

16 4 Operation Browser Mozilla FireFox Internet Explorer Version 30.1 and later 11.0 and later Step 3 Enter the login username (admin) and password. Then click Log In or press Enter, as shown in Figure 4-3. Figure 4-3 Logging in to HexaTier ----End 4.2 How Do I Run the Agent Program? This section describes how to run the database audit agent program. After a database is successfully added and the audit function is enabled, perform the following steps to run the agent program: Step 1 Log in to the management console. Step 2 Click in the upper left corner of the management console and select a region or project. Step 3 Step 4 On the top of the console, click Service List and choose Security > Database Security Service. In the navigation tree on the left, choose > Database Audit. The database audit instances page is displayed. Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 12

17 4 Operation Step 5 In the database audit instance list, click the name of the instance for which you want to add and download an agent. See Figure 4-4. Figure 4-4 Database audit instance list Step 6 On the Instance Details page, choose Maintenance > Database Management. The database list page is displayed. Step 7 In the Agent column of the desired database, click Add Agent. See Figure 4-5. Figure 4-5 Adding an agent Step 8 In the Add Agent dialog box, select an adding mode. See Figure 4-6, Figure 4-7, and Figure 4-8. Table 4-2 describes the parameters. Figure 4-6 Selecting an existing agent Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 13

18 4 Operation Figure 4-7 Adding an agent to a database Figure 4-8 Adding an agent to an application Table 4-2 Parameters for adding an agent Parameter Description Example Value Add Mode Mode for adding an agent Select an existing agent If you have added an agent to the database, you can select the agent. Create an agent If you have not added an agent to the database, create an agent based on the audited database type. Select an existing agent Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 14

19 4 Operation Parameter Description Example Value Database Name Agent ID Installing Node Type Installing Node IP Address Audited NIC Name CPU Threshold (%) Memory Threshold (%) Name of a database to which the agent is added This parameter is configurable when Add Mode is set to Select an existing agent. ID of an agent to be added This parameter is configurable when Add Mode is set to Select an existing agent. You can select the installing node based on your needs. The options are: Database This parameter is mandatory when auditing databases of ECS/BMS. Application This parameter is mandatory when auditing RDS applications. This parameter is mandatory when Add Agent is set to Creat an agent. IP address of the server where an agent is installed This parameter is mandatory when Installing Node Type is set to Application. (Optional) Name of the network interface card (NIC) of the application server to be audited This parameter is configurable when Installing Node Type is set to Application. (Optional) CPU threshold of the application server to be audited. The default value is 80. This parameter is configurable when Installing Node Type is set to Application. (Optional) Memory threshold of the application server to be audited. The default value is 80. This parameter is configurable when Installing Node Type is set to Application. test - Database Step 9 Click OK. Step 10 Click to see the detailed information about the database. In the Operation column, click Download, as shown in Figure 4-9, to download an agent installation package. Figure 4-9 Downloading an agent Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 15

20 4 Operation Step 11 Upload the downloaded agent installation package xxx.tar to the server (for example, using WinSCP). Step 12 Step 13 Log in to the server as user root using SSH through a cross-platform remote access tool (for example PuTTY). Run the following command to access the directory where the agent installation package xxx.tar is stored: cd directory containing the installation package Step 14 Run the following command to decompress the FusionCloud Deploy installation package xxx.tar: tar -xf xxx.tar Step 15 Run the following command to install the agent: sh install.sh If the following information is displayed, the agent has been installed successfully: start agent starting audit agent audit agent started start success install dbss audit agent done! Step 16 Run the following command to view the running status of the agent program: ps -ef grep audit_agent If the following information is displayed, the agent program is running properly: /opt/dbss_audit_agent/bin/audit_agent Step 17 Run the following command to check the communication between the agent and the audit server: tailf /opt/dbss_audit_agent/log/audit_agent.log If the following information is displayed, the communication between the agent and the audit server is normal. Figure 4-10 Normal communication ----End 4.3 How Do I Uninstall the Agent Program? This section describes how to uninstall the database audit agent. After a database is successfully added and the audit function is enabled, perform the following steps to uninstall the agent program: Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 16

21 4 Operation Step 1 Log in to the server as user root using SSH through a cross-platform remote access tool (for example PuTTY). Step 2 Run the following command to uninstall the agent: sh /opt/dbss_audit_agent/uninstall.sh ----End 4.4 How Do I View the Status of the Agent Program? This section describes how to view the status of the agent program. After an agent is installed on the database, perform the following steps to view the running status of the agent program: Step 1 Step 2 Log in to the server as user root using SSH through a cross-platform remote access tool (for example PuTTY). Run the following command to view the running status of the agent program: ps -ef grep audit_agent If the following information is displayed, the agent program is running properly: /opt/dbss_audit_agent/bin/audit_agent ----End 4.5 How Do I Check the Version of Database Audit? This section describes how to view the version of database audit. To check the version of database audit, perform the following steps: Step 1 Log in to the management console. Step 2 Click in the upper left corner of the management console and select a region or project. Step 3 Step 4 Step 5 On the top of the console, click Service List and choose Security > Database Security Service. In the navigation tree on the left, choose > Database Audit. The database audit instances page is displayed. In the database audit instance list, click the name of the instance for which you want to view the basic information, as shown in Figure Figure 4-11 Database audit instance list Step 6 On the Instance Details page, click Basic Info. Step 7 View the instance version, as shown in Figure Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 17

22 4 Operation Figure 4-12 Viewing the instance version ----End 4.6 How Do I View All Alarms in Database Audit? This section describes how to view alarms in database audit. To check the alarms of database audit, perform the following steps: Step 1 Log in to the management console. Step 2 Click in the upper left corner of the management console and select a region or project. Step 3 Step 4 Step 5 On the top of the console, click Service List and choose Security > Database Security Service. In the navigation tree on the left, choose > Database Audit. The database audit instances page is displayed. In the database audit instance list, click the name of the instance for which you want to view the alarm monitoring, as shown in Figure Figure 4-13 Database audit instance list Step 6 On the Instance Details page, choose Maintenance > Alarm Monitoring. The Alarm Monitoring page is displayed. Step 7 View the alarm monitoring information, as shown in Figure Figure 4-14 Viewing the alarm monitoring information To query specified alarms, perform the following steps: Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 18

23 4 Operation Select a time, or click, select the start time and end time, and click Submit. The alarm monitoring information in the specified period is displayed in the list. If you select a risk severity, the alarm monitoring information under this severity is displayed in the list. If you select an alarm type, the alarm monitoring information of this type is displayed in the list. ----End Issue 19 ( ) Copyright Huawei Technologies Co., Ltd. 19