本文介绍在GBase 8a 数据库集群里，在涉及密码明文的安全保护方面处理措施，确保密码明文不会被获得。包括命令行登录密码，SQL语句里连接数据源的密码，同时在数据库日志里也需要屏蔽。
目录导航
命令行工具gccli进程登录密码
登录数据库输入了密码。
[gbase@gbase_rh7_001 ~]$ gccli -ugbase -pgbase20110531 -e"select sleep(100)"
+------------+
| sleep(100) |
+------------+
| 0 |
+------------+
[gbase@gbase_rh7_001 ~]$
ps查看进程信息没有明文
Last login: Mon Mar 29 13:58:31 2021 from 192.168.56.1
[root@gbase_rh7_001 ~]#
[root@gbase_rh7_001 ~]# ps -ef|grep gccli
gbase 4546 3381 0 14:19 pts/0 00:00:00 gccli -ugbase -pxxxxxxxxxxxxx -eselect sleep(100)
root 4900 4726 0 14:19 pts/1 00:00:00 grep --color=auto gccli
[root@gbase_rh7_001 ~]#
SQL语句包含数据源密码
[gbase@gbase_rh7_001 ~]$ gccli -ugbase -pgbase20110531 -e"load data infile 'sftp://gbase:gbase1234@10.0.2.202/home/1/txt' into table vc1.testdb.t1 "
查看进程 show processlist，没有发现明文
+----+-----------------+-----------+------+------+---------+------+-----------------------------+------------------------------------------------------------------------------------------+
| Id | User | Host | vc | db | Command | Time | State | Info |
+----+-----------------+-----------+------+------+---------+------+-----------------------------+------------------------------------------------------------------------------------------+
| 1 | event_scheduler | localhost | NULL | NULL | Daemon | 1604 | Waiting for next activation | NULL |
| 25 | gbase | localhost | NULL | NULL | Query | 3 | checking permissions | load data infile 'sftp://gbase:*********@10.0.2.202/home/1/txt' into table vc1.testdb.t1 |
| 29 | root | localhost | NULL | NULL | Query | 0 | NULL | show processlist |
+----+-----------------+-----------+------+------+---------+------+-----------------------------+--------------------------------------------------------------------日志
gcluster/log/express.log, 没有看到明文。
2021-03-29 14:26:20.206 [LOAD][ERROR][S:25][Q:39]<ExecuteLoad|1798>:I/O operation on sftp://gbase:*********@10.0.2.202/home/1/txt failed with error - Couldn't connect to server, File name sftp://gbase:*********@10.0.2.202/home/1/txt
审计日志，没有看到明文
# Threadid=36;
# Taskid=2228257;
# Time: 210329 14:40:35
# End_time: 210329 14:40:38
# User@Host: gbase[gbase] @ localhost []
# UID: 2
# Query_time: 3.058889 Rows: 0
# Tables: WRITE: `vc00001`.`testdb`.`t1`; READ: ; OTHER: ; ;
# SET timestamp=1617000035;
# Sql_text: load data infile 'sftp://gbase:*********@10.0.2.202/home/1/txt' into table vc1.testdb.t1;
# Sql_type: DML;
# Sql_command: LOAD;
# Status: FAILED;
# Connect Type: ODBC;