Access Rules to Apply on the Teradata Database Appliance

This section provides the instructions for creating a sample policy and signature sets specific to a Teradata Database Appliance to deny unprivileged users access to clear-text data on guarded devices. Such a policy requires the inclusion of specific security rules to restrict access to the Teradata Device GuardPoints for specific set of users, groups, and/or processes.

Note

You must add binaries to client settings to allow trusted processes to access policies. Failure to do so results in a User not Authenticated error which prevents access for user-based policies. For example, when using tvsa_agent for a Teradata cluster, you must add `/usr/pde/bin/tvsa_agent`` as an authenticator in the client settings.

1. In the CipherTrust Manager, edit the host/client entry for the Teradata Database Appliance.

2. Go to the Host/Client Settings tab and add the following entries to the list of binaries:

   • |authenticator|/usr/pde/bin/pdemain

   • |authenticator|/opt/teradata/sm3g/bin/tdsmagent

   • |authenticator|/usr/pde/bin/pcl

   • |authenticator|/opt/teradata/TDput/bin/putservices

   • |authenticator|/usr/pde/bin/tvam

3. Create a signature set for system processes that require access to guarded devices. The following system processes on the Teradata Database Appliance must be permitted access:

   • /usr/lib/systemd/systemd-udevd

   • /sbin/dmsetup

   • /opt/teradata/vormetric/agent/vmd/bin/get_disks

   • /sbin/pvdisplay

   • /sbin/lvdisplay

   • /usr/sbin/parted

   You can include additional processes as needed.

4. Create a signature set for Teradata Database processes that require access to guarded devices. The following directories contain the Teradata binaries that require access:

   • /usr/pde/bin/*

   • /usr/tdbms/bin/*

   • /opt/teradata/gsctools/bin/*

   • /opt/teradata/TDput/bin/*

   You can include additional processes as needed.

5. Create a system-level process set to associate the system-level processes listed in step 3, with the signature set you created in step 3. In the following example, this process set is called TD-Demo-system-process.

   

6. Create a Teradata Database process set to associate the signature set for the Teradata Database binaries created in step 4.

   

7. Create the user set for the Teradata trusted group on your appliance.

8. If you have any other trusted groups that you want to include in your security rule, add a user set for each one of those trusted groups. You can add as many user sets to the policy as you need.

9. Create a user set for the root user and any other privileged users you want to add.

10. Verify that you have the complete signature sets, process sets, and user sets as shown in the examples below.

11. Apply the policy to the Teradata Device GuardPoints.