南大通用GBase 8a 对明文密码的安全保护措施

本文介绍在GBase 8a 数据库集群里,在涉及密码明文的安全保护方面处理措施,确保密码明文不会被获得。包括命令行登录密码,SQL语句里连接数据源的密码,同时在数据库日志里也需要屏蔽。

命令行工具gccli进程登录密码

登录数据库输入了密码。

[gbase@gbase_rh7_001 ~]$ gccli -ugbase -pgbase20110531 -e"select sleep(100)"
+------------+
| sleep(100) |
+------------+
|          0 |
+------------+
[gbase@gbase_rh7_001 ~]$

ps查看进程信息没有明文

Last login: Mon Mar 29 13:58:31 2021 from 192.168.56.1
[root@gbase_rh7_001 ~]#
[root@gbase_rh7_001 ~]# ps -ef|grep gccli
gbase     4546  3381  0 14:19 pts/0    00:00:00 gccli -ugbase -pxxxxxxxxxxxxx -eselect sleep(100)
root      4900  4726  0 14:19 pts/1    00:00:00 grep --color=auto gccli
[root@gbase_rh7_001 ~]#

SQL语句包含数据源密码

[gbase@gbase_rh7_001 ~]$ gccli -ugbase -pgbase20110531 -e"load data infile 'sftp://gbase:gbase1234@10.0.2.202/home/1/txt' into table vc1.testdb.t1 "

查看进程 show processlist,没有发现明文

+----+-----------------+-----------+------+------+---------+------+-----------------------------+------------------------------------------------------------------------------------------+
| Id | User            | Host      | vc   | db   | Command | Time | State                       | Info                                                                                     |
+----+-----------------+-----------+------+------+---------+------+-----------------------------+------------------------------------------------------------------------------------------+
|  1 | event_scheduler | localhost | NULL | NULL | Daemon  | 1604 | Waiting for next activation | NULL                                                                                     |
| 25 | gbase           | localhost | NULL | NULL | Query   |    3 | checking permissions        | load data infile 'sftp://gbase:*********@10.0.2.202/home/1/txt' into table vc1.testdb.t1 |
| 29 | root            | localhost | NULL | NULL | Query   |    0 | NULL                        | show processlist                                                                         |
+----+-----------------+-----------+------+------+---------+------+-----------------------------+--------------------------------------------------------------------

日志

gcluster/log/express.log, 没有看到明文。

2021-03-29 14:26:20.206 [LOAD][ERROR][S:25][Q:39]<ExecuteLoad|1798>:I/O operation on sftp://gbase:*********@10.0.2.202/home/1/txt failed with error - Couldn't connect to server, File name sftp://gbase:*********@10.0.2.202/home/1/txt

审计日志,没有看到明文

# Threadid=36;
# Taskid=2228257;
# Time: 210329 14:40:35
# End_time: 210329 14:40:38
# User@Host: gbase[gbase] @ localhost []
# UID: 2
# Query_time: 3.058889 Rows: 0
# Tables: WRITE: `vc00001`.`testdb`.`t1`; READ: ; OTHER: ; ;
# SET timestamp=1617000035;
# Sql_text: load data infile 'sftp://gbase:*********@10.0.2.202/home/1/txt' into table vc1.testdb.t1;
# Sql_type: DML;
# Sql_command: LOAD;
# Status: FAILED;
# Connect Type: ODBC;