Greenplum Command Center Security
Greenplum Command Center Security
Greenplum Command Center (GPCC) is a web-based application for monitoring and managing Greenplum clusters. GPCC works with data collected by agents running on the segment hosts and saved to the gpperfmon database. The gpperfmon database is created by running the gpperfmon_install utility, which also creates the gpmon database role that GPCC uses to access the gpperfmon database.
The gpmon User
local gpperfmon gpmon md5 host all gpmon 127.0.0.1/28 md5 host all gpmon ::1/128 md5These entries allow gpmon to establish a local socket connection to the gpperfmon database and a TCP/IP connection to any database.
local gpperfmon gpmon md5 host gpperfmon gpmon 127.0.0.1/28 md5 host gpperfmon gpmon ::1/128 md5
The password used to authenticate the gpmon user is set by the gpperfmon_install utility and is stored in the gpadmin home directory in the ~/.pgpass file. The ~/.pgpass file must be owned by the gpadmin user and be RW-accessible only by the gpadmin user. To change the gpmon password, use the ALTER ROLE command to change the password in the database, change the password in the ~/.pgpass file, and then restart GPCC with the gpcmdr --restart instance_name command.
GPCC does not allow logins from any role configured with trust authentication, including the gpadmin user.
The gpmon user can log in to the Command Center Console and has access to all of the application's features. You can allow other database roles access to GPCC so that you can secure the gpmon user and restrict other users' access to GPCC features. Setting up other GPCC users is described in the next section.
Greenplum Command Center Users
- Self Only users can view metrics and view and cancel their own queries. Any Greenplum Database user successfully authenticated through the Greenplum Database authentication system can access Greenplum Command Center with Self Only permission. Higher permission levels are required to view and cancel other’s queries and to access the System and Admin Control Center features.
- Basic users can view metrics, view all queries, and cancel their own queries. Users with Basic permission are members of the Greenplum Database gpcc_basic group.
- Operator Basic users can view metrics, view their own and others’ queries, cancel their own queries, and view the System and Admin screens. Users with Operator Basic permission are members of the Greenplum Database gpcc_operator_basic group.
- Operator users can view their own and others’ queries, cancel their own and other’s queries, and view the System and Admin screens. Users with Operator permission are members of the Greenplum Database gpcc_operator group.
- Admin users can access all views and capabilities in the Command Center. Greenplum Database users with the SUPERUSER privilege have Admin permissions in Command Center.
To log in to the GPCC web application, a user must be allowed access to the gpperfmon database in pg_hba.conf. For example, to make user1 a regular GPCC user, edit the pg_hba.conf file and either add or edit a line for the user so that the gpperfmon database is included in the database field. For example:
host gpperfmon,accounts user1 127.0.0.1/28 md5
=# GRANT gpcc_operator TO user;
You can also grant gpcc_operator to a group role to make all members of the group GPCC operators.
See the gpperfmon_install reference in Greenplum Database Utility Guide for more information about managing the gpperfmon database.
Enabling SSL for Greenplum Command Center
The GPCC web server can be configured to support SSL so that client connections are encrypted. A server certificate can be generated when the Command Center instance is created or you can supply an existing certificate.
Two-way authentication with public key encryption can also be enabled for GPCC. See the Greenplum Command Center Administration Guide for instructions.
Enabling Kerberos Authentication for Greenplum Command Center Users
If Kerberos authentication is enabled for Greenplum Database, Command Center users can also authenticate with Kerberos. Command Center supports three Kerberos authentication modes: strict, normal, and gpmon-only.
- Command Center has a Kerberos keytab file containing the Command Center service principal and a principal for every Command Center user. If the principal in the client’s connection request is in the keytab file, the web server grants the client access and the web server connects to Greenplum Database using the client’s principal name. If the principal is not in the keytab file, the connection request fails.
- The Command Center Kerberos keytab file contains the Command Center principal and may contain principals for Command Center users. If the principal in the client’s connection request is in Command Center’s keytab file, it uses the client’s principal for database connections. Otherwise, Command Center uses the gpmon user for database connections.
- The Command Center uses the gpmon database role for all Greenplum Database connections. No client principals are needed in the Command Center’s keytab file.
See the Greenplum Command Center documentation for instructions to enable Kerberos authentication with Greenplum Command Center