- Platform Release 6.5
- Privacera Platform Installation
- Privacera Platform User Guide
- Privacera Discovery User Guide
- Privacera Encryption Guide
- Privacera Access Management User Guide
- AWS User Guide
- Overview of Privacera on AWS
- Configure policies for AWS services
- Using Athena with data access server
- Using DynamoDB with data access server
- Databricks access manager policy
- Accessing Kinesis with data access server
- Accessing Firehose with Data Access Server
- EMR user guide
- AWS S3 bucket encryption
- Getting started with Minio
- Plugins
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- Privacera Platform documentation changelog
Default services configuration
Policy Store
AWS Aurora DB (PostgreSQL/MySQL)
RDS - Aurora DB
PostgreSQL
This topic allows you to configure External RDS Aurora DB with PostGres flavour for Portal, Ranger, Ranger KMS, Access Request Manager.
Prerequisites
Before you begin, ensure the following prerequisites are met:
Create RDS Aurora DB with PostGres flavour with a database name. You'll need to use the database name in the Configuration section below.
Note
The RDS database name which you will be entering in the Configuration section below should be created in advance. Privacera does not create a RDS database, but only creates table schemas.
If you have installed Privacera using the internal Maria DB and wish to move from the internal database to an external PostgreSQL DB, then you will have to delete the Maria DB container/pod. For more information, see Service Commands.
CLI configuration
SSH to the instance where Privacera is installed.
Run the following command.
cd ~/privacera/privacera-manager cp config/sample-vars/vars.external.db.postgres.yml config/custom-vars/ vi config/custom-vars/vars.external.db.postgres.yml
In this file set values for the following:
Set the following as False.
DB_INSTALL_MARIADB: "false"
Enter the hostname of the AWS PostgreSQL server, and the name of the database you want to connect to. Get the name of the database from the Prerequisites section above.
EXTERNAL_DB_HOST: "<PLEASE_CHANGE>" EXTERNAL_DB_NAME: "<PLEASE_CHANGE>"
Enter the credentials of the user who has access to the database.
EXTERNAL_DB_USER: "<PLEASE_CHANGE>" EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"
(Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.
PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"Save and Exit.
Run the following command.
cd ~/privacera/privacera-manager ./privacera-manager.sh update
MySQL
This topic allows you to configure External RDS Aurora DB with MySQL flavour for Portal, Ranger, Ranger KMS, Access Request Manager.
Prerequisites
Before you begin, ensure the following prerequisites are met:
Create RDS Aurora DB with MySQL flavour with a database name. You'll need to use the database name in the Configuration section below.
Note
The RDS database name which you will be entering in the Configuration section below should be created in advance. Privacera does not create a RDS database, but only creates table schemas.
If you have installed Privacera using the internal Maria DB and wish to move from the internal database to an external MySQL DB, then you will have to delete the Maria DB container/pod. For more information, see Service Commands.
CLI configuration
SSH to the instance where Privacera is installed.
Run the following command.
cd ~/privacera/privacera-manager cp config/sample-vars/vars.external.db.mysql.yml config/custom-vars/ vi config/custom-vars/vars.external.db.mysql.yml
In this file set values for the following:
Set the following as False.
DB_INSTALL_MARIADB: "false"
Enter the hostname of the AWS MySQL server, and the name of the database you want to connect to. Get the name of the database from the Prerequisites section above.
EXTERNAL_DB_HOST: "<PLEASE_CHANGE>" EXTERNAL_DB_NAME: "<PLEASE_CHANGE>"
Enter the credentials of the user who has access to the database.
EXTERNAL_DB_USER: "<PLEASE_CHANGE>" EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"
(Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.
PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"Save and Exit.
Run the following command.
cd ~/privacera/privacera-manager ./privacera-manager.sh update
Note
Make sure you're familiar with encryption for Aurora. See the Aurora documentation.
Azure PostgreSQL
This topic allows you to connect to an Azure PostgreSQL server from the Azure virtual machine which will act as a storage for Ranger database and Privacera database (Optional).
Prerequisites
Before you begin, ensure the following prerequisite are met:
Create a privacera_db database in the Azure PostgreSQL server that can be accessible.
CLI Configuration
SSH to the instance where Privacera is installed.
Run the following command.
cd ~/privacera/privacera-manage cp config/sample-vars/vars.external.db.yml config/custom-vars/ cp config/sample-vars/vars.external.db.postgres.yml config/custom-vars/ vi config/custom-vars/vars.external.db.postgres.yml
In this file set values for the following:
Enter the hostname of the Azure PostgreSQL server, and the name of the database you want to connect to.
EXTERNAL_DB_HOST: "<PLEASE_CHANGE>" EXTERNAL_DB_NAME: "privacera_db"
Enter the credentials of the user who has access to the database.
EXTERNAL_DB_USER: "<PLEASE_CHANGE>" EXTERNAL_DB_PASSWORD: "<PLEASE_CHANGE>"
(Optional) Enter a database name for Privacera Portal, Privacera Ranger, and Privacera Ranger KMS. It is recommended to provide different names for the 3 databases.
PRIVACERA_PORTAL_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_DB_NAME: "{{EXTERNAL_DB_NAME}}" PRIVACERA_RANGER_KMS_DB_NAME: "{{EXTERNAL_DB_NAME}}"
Validation
Login to Privacera portal.
Go to Access Management > Resource Policies. You should be able to see the Postgres service.
AuditServer
Configure Solr destination
Configure Solr destination
This topic covers how you can set up an AuditServer to receive audits from Privacera Plugins and Ranger Admin and send those audits to Solr and Fluentd. If you choose to keep the audits beyond a 90-day period, you can use AuditServer for that purpose.
By default, the Ranger plugin sends the audits to Solr, where the audits expire after a 90-day period. If you want to configure the audit log expiry period, see MAX_AUDIT_RETENTION_DAYS property in the Solr properties.
CLI configuration
SSH to an instance where Privacera is installed.
Run the following commands.
cd ~/privacera/privacera-manager cp config/sample-vars/vars.auditserver.yml config/custom-vars/ vi config/custom-vars/vars.auditserver.yml
Edit the following properties. For property details and description, refer to the Configuration Properties below.
AUDITSERVER_AUTH_TYPE: "<PLEASE_CHANGE>" AUDITSERVER_AUTH_USER: "<PLEASE_CHANGE>" AUDITSERVER_AUTH_PASSWORD: "<PLEASE_CHANGE>" AUDITSERVER_SOLR_DESTINATION: "<PLEASE_CHANGE>" ADMIN_AUDITSERVER_SOLR_DESTINATION: "<PLEASE_CHANGE>"
Run the following commands.
cd ~/privacera/privacera-manager ./privacera-manager.sh update
Related Information
For further reading, see Unable to view the audits
Configuration properties
The property names prefixed with ADMIN_ refer to Privacera Ranger Admin, whereas the others refer to Privacera Portal.
Property | Description | Example |
|---|---|---|
AUDITSERVER_AUTH_TYPE | Set this property to enable basic authentication. Value: None/Basic | basic |
AUDITSERVER_AUTH_USER AUDITSERVER_AUTH_PASSWORD | If the above authentication type is set to basic, assign a username and password. You can assign any user credentials. Value: True/False | AUDITSERVER_AUTH_USER: "padmin" AUDITSERVER_AUTH_PASSWORD: "padmin" |
AUDITSERVER_SOLR_DESTINATION ADMIN_AUDITSERVER_SOLR_DESTINATION | Set to true if the audit destination is Solr. |
Configure Kafka destination
This topic covers how you can configure Kafka audit endpoint in AuditServer for the Ranger plugin and the Ranger Admin to send the audits.
Prerequisites
Ensure the following prerequisites are met:
AuditServer must be configured. For more information, click here.
CLI configuration
SSH to an instance where Privacera is installed.
Run the following commands.
cd ~/privacera/privacera-manager cp config/sample-vars/vars.auditserver.kafka.destination.yml config/custom-vars/ vi config/custom-vars/vars.auditserver.kafka.destination.yml
Modify the properties. For property details and description, refer to the Configuration Properties below.
AUDITSERVER_KAFKA_DESTINATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_BROKER_LIST:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_TOPIC_NAME:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SECURITY_PROTOCOL:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_KEY_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_JAAS_CONFIG:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_MECHANISM:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_WITH_SSL:"<PLEASE_CHANGE>"AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER:"<PLEASE_CHANGE>"AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_CLIENT_ID:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET:"<PLEASE_CHANGE>"AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR:"/workdir/privacera-audit-server/kafka-spool"ADMIN_AUDITSERVER_KAFKA_DESTINATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_BROKER_LIST:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_TOPIC_NAME:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SECURITY_PROTOCOL:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_KEY_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_JAAS_CONFIG:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_MECHANISM:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_WITH_SSL:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_ID:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET:"<PLEASE_CHANGE>"ADMIN_AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR:"/workdir/privacera-audit-server/kafka-spool"
Run the following commands.
cd ~/privacera/privacera-manager ./privacera-manager.sh update
Configuration properties
The property names prefixed with ADMIN_ refer to Privacera Ranger Admin, whereas the others refer to Privacera Portal.
Property | Description | Example |
|---|---|---|
AUDITSERVER_KAFKA_DESTINATION ADMIN_AUDITSERVER_KAFKA_DESTINATION | Set to true if audit destination is kafka | |
AUDITSERVER_KAFKA_BROKER_LIST ADMIN_AUDITSERVER_KAFKA_BROKER_LIST | A list of host/port pairs to use for establishing the initial connection to the Kafka cluster. This list should be in the form host1:port1,host2:port2,.... Since these servers are just used for the initial connection to discover the full cluster membership (which may change dynamically), this list need not contain the full set of servers (you may want more than one, though, in case a server is down). | 10.xxx.xx.xxx:9093 |
AUDITSERVER_KAFKA_TOPIC_NAME ADMIN_AUDITSERVER_KAFKA_TOPIC_NAME | Topic name to which audits are to be sent | topic-name |
AUDITSERVER_KAFKA_SECURITY_PROTOCOL ADMIN_AUDITSERVER_KAFKA_SECURITY_PROTOCOL | Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL. | SASL_SSL |
AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION | The location of the key store file. Make sure key is copied in config/ssl folder. Provide name of the file. | kafka.server.keystore |
AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD ADMIN_AUDITSERVER_KAFKA_SSL_KEYSTORE_PASSWORD | The store password for the key store file.This is optional and only needed if AUDITSERVER_KAFKA_SSL_KEYSTORE_LOCATION is configured. | privacera |
AUDITSERVER_KAFKA_SSL_KEY_PASSWORD ADMIN_AUDITSERVER_KAFKA_SSL_KEY_PASSWORD | The password of the private key in the key store file. This is optional. | privacera |
AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_LOCATION | The location of the trust store file. Make sure the key is copied in config/ssl folder. Provide name of the file. | kafka.server.truststore |
AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD ADMIN_AUDITSERVER_KAFKA_SSL_TRUSTSTORE_PASSWORD | The password for the trust store file. | privacera |
AUDITSERVER_KAFKA_SASL_JAAS_CONFIG ADMIN_AUDITSERVER_KAFKA_SASL_JAAS_CONFIG | Kafka uses the Java Authentication and Authorization Service (JAAS) for SASL configuration. You must provide JAAS configurations for all SASL authentication mechanisms. E.g "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;" if AUDITSERVER_KAFKA_SASL_MECHANISM is "OAUTHBEARER | org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ; |
AUDITSERVER_KAFKA_SASL_MECHANISM ADMIN_AUDITSERVER_KAFKA_SASL_MECHANISM | SASL mechanism used for connections. This may be any mechanism for which a security provider is available. GSSAPI is the default mechanism. | OAUTHBEARER |
AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS ADMIN_AUDITSERVER_KAFKA_SASL_LOGIN_CALLBACK_HANDLER_CLASS | The LoginModule for the selected SASL_MECHANISM E.g "io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler" if AUDITSERVER_KAFKA_SASL_MECHANISM is "OAUTHBEARER | io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler |
AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI ADMIN_AUDITSERVER_KAFKA_OAUTH_TOKEN_ENDPOINT_URI | OAUTH Token endpoint URL used by the application in order to get an access token or a refresh token | http://10.211.93.140:4444/oauth2/token |
AUDITSERVER_KAFKA_OAUTH_WITH_SSL ADMIN_AUDITSERVER_KAFKA_OAUTH_WITH_SSL | Set to true if SSL is applied on OAUTH. | |
AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER ADMIN_AUDITSERVER_OAUTH_ACCEPT_UNSECURE_SERVER | Set to true if OAUTH accept unsecure server. | |
AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE ADMIN_AUDITSERVER_OAUTH_LOGIN_GRANT_TYPE | The authorization server needs to know which grant type the application wants to use since it affects the kind of credential it will issue e.g client_credentials | client_credentials |
AUDITSERVER_KAFKA_OAUTH_CLIENT_ID ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_ID | The ID of the application that asks for authorization. | broker-kafka |
AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET ADMIN_AUDITSERVER_KAFKA_OAUTH_CLIENT_SECRET | The secret of the application that asks for authorization. | broker-kafka |
AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR ADMIN_AUDITSERVER_KAFKA_BATCH_FILESPOOL_DIR | If audit framework detects that an audit destination is down then it buffers the audit messages in memory. Once memory buffer fills up then it can be configured to spool the unsent messages to disk files to prevent or minimize the loss of audit messages. Local disk directory where spool files would be kept. This value must be specified. Default location is "/workdir/privacera-audit-server/kafka-spool | /workdir/privacera-audit-server/kafka-spool |
Solr authentication
This topic covers how to handle basic Solr authentication for servers and clients.
CLI configuration
SSH to the instance where Privacera is installed.
Run the following commands.
cd ~/privacera/privacera-manager cp config/sample-vars/vars.solr.auth.yml config/custom-vars/ vi config/custom-vars/vars.solr.auth.yml
Modify the properties below. For property details and description, refer to the Configuration Properties below.
SOLR_BASIC_AUTH_ENABLED: <PLEASE_CHANGE> SOLR_BASIC_AUTH_USER: <PLEASE_CHANGE> SOLR_BASIC_AUTH_PASSWORD: <PLEASE_CHANGE>
Note
You can also add custom properties that are not included by default. See Solr.
Run the following commands.
cd ~/privacera/privacera-manager ./privacera-manager.sh update
Configuration properties
Property | Description |
|---|---|
| Set this property to true to enable the basic authentication. |
| Assign the user credentials for the Solr authentication. |
Zookeeper
Restrict access in Kubernetes
This topic covers how you can restrict access to a Zookeeper pod in a Kubernetes environment.
You can enable/disable a range of source IPs that can access a Zookeeper pod.
Configuration
Create
vars.zk-access.ymlfile.cd ~/privacera/privacera-manager vi config/custom-vars/vars.zk-access.yml
Add the following property, and enter the correct network CIDR Address. For example, 172.20.0.0/16.
ZOOKEEPER_K8S_NETWORKING_LOADBALANCER_SOURCE_RANGES:-"<PLEASE_UPDATE>"
Run the following command.
cd ~/privacera/privacera-manager ./privacera-manager.sh update