Greenplum Command Center Security

    The gpperfmon_install utility creates the gpmon database role and adds the role to the pg_hba.conf file with the following entries:

    These entries allow gpmon to establish a local socket connection to the gpperfmon database and a TCP/IP connection to any database.

    The gpmon database role is a superuser. In a secure or production environment, it may be desirable to restrict the gpmon user to just the gpperfmon database. Do this by editing the gpmon host entry in the pg_hba.conf file and changing all in the database field to :

    The password used to authenticate the gpmon user is set by the gpperfmon_install utility and is stored in the gpadmin home directory in the ~/.pgpass file. The ~/.pgpass file must be owned by the gpadmin user and be RW-accessible only by the gpadmin user. To change the gpmon password, use the ALTER ROLE command to change the password in the database, change the password in the ~/.pgpass file, and then restart GPCC with the gpcmdr --restart instance\_name command.

    Note: The GPCC web server can be configured to encrypt connections with SSL. Two-way authentication with public keys can also be enabled for GPCC users. However, the gpmon user always uses md5 authentication with the password saved in the ~/.pgpass file.

    GPCC does not allow logins from any role configured with trust authentication, including the gpadmin user.

    The gpmon user can log in to the Command Center Console and has access to all of the application’s features. You can allow other database roles access to GPCC so that you can secure the user and restrict other users’ access to GPCC features. Setting up other GPCC users is described in the next section.

    • Self Only users can view metrics and view and cancel their own queries. Any Greenplum Database user successfully authenticated through the Greenplum Database authentication system can access Greenplum Command Center with Self Only permission. Higher permission levels are required to view and cancel others’ queries and to access the System and Admin Control Center features.
    • Operator Basic users can view metrics, view their own and others’ queries, cancel their own queries, and view the System and Admin screens. Users with Operator Basic permission are members of the Greenplum Database gpcc_operator_basic group.
    • Operator users can view their own and others’ queries, cancel their own and others’ queries, and view the System and Admin screens. Users with Operator permission are members of the Greenplum Database gpcc_operator group.

    To log in to the GPCC web application, a user must be allowed access to the gpperfmon database in pg_hba.conf. For example, to make user1 a regular GPCC user, edit the pg_hba.conf file and either add or edit a line for the user so that the gpperfmon database is included in the database field. For example:

    To designate a user as an operator, grant the gpcc_operator role to the user:

    You can also grant gpcc_operator to a group role to make all members of the group GPCC operators.

    See the gpperfmon_install reference in Greenplum Database Utility Guide for more information about managing the gpperfmon database.

    The GPCC web server can be configured to support SSL so that client connections are encrypted. A server certificate can be generated when the Command Center instance is created or you can supply an existing certificate.

    Two-way authentication with public key encryption can also be enabled for GPCC. See the Greenplum Command Center Administration Guide for instructions.

    If Kerberos authentication is enabled for Greenplum Database, Command Center users can also authenticate with Kerberos. Command Center supports three Kerberos authentication modes: strict, normal, and gpmon-only.

    Command Center has a Kerberos keytab file containing the Command Center service principal and a principal for every Command Center user. If the principal in the client’s connection request is in the keytab file, the web server grants the client access and the web server connects to Greenplum Database using the client’s principal name. If the principal is not in the keytab file, the connection request fails.

    Normal

    The Command Center Kerberos keytab file contains the Command Center principal and may contain principals for Command Center users. If the principal in the client’s connection request is in Command Center’s keytab file, it uses the client’s principal for database connections. Otherwise, Command Center uses the gpmon user for database connections.

    gpmon-only

    The Command Center uses the gpmon database role for all Greenplum Database connections. No client principals are needed in the Command Center’s keytab file.

    See the Greenplum Command Center documentation for instructions to enable Kerberos authentication with Greenplum Command Center

    Parent topic: