Access Rules to Apply on the Teradata Database Appliance
This section provides the instructions for creating a sample policy and signature sets specific to a Teradata Database Appliance to deny unprivileged users access to clear-text data on guarded devices. Such a policy requires the inclusion of specific security rules to restrict access to the Teradata Device GuardPoints for specific set of users, groups, and/or processes.
Note
You must add binaries to client settings to allow trusted processes to access policies. Failure to do so results in a User not Authenticated error which prevents access for user-based policies. For example, when using tvsa_agent for a Teradata cluster, you must add /usr/pde/bin/tvsa_agent as an authenticator in the client settings.
-
In the CipherTrust Manager, edit the host/client entry for the Teradata Database Appliance.
-
Go to the Host/Client Settings tab and add the following entries to the list of binaries:
-
|authenticator|/usr/pde/bin/pdemain
-
|authenticator|/opt/teradata/sm3g/bin/tdsmagent
-
|authenticator|/usr/pde/bin/pcl
-
|authenticator|/opt/teradata/TDput/bin/putservices
-
|authenticator|/usr/pde/bin/tvam
-
-
Create a signature set for system processes that require access to guarded devices. The following system processes on the Teradata Database Appliance must be permitted access:
-
/usr/lib/systemd/systemd-udevd
-
/sbin/dmsetup
-
/opt/teradata/vormetric/agent/vmd/bin/get_disks
-
/sbin/pvdisplay
-
/sbin/lvdisplay
-
/usr/sbin/parted
You can include additional processes as needed.
-
-
Create a signature set for Teradata Database processes that require access to guarded devices. The following directories contain the Teradata binaries that require access:
-
/usr/pde/bin/*
-
/usr/tdbms/bin/*
-
/opt/teradata/gsctools/bin/*
-
/opt/teradata/TDput/bin/*
You can include additional processes as needed.
-
-
Create a system-level process set to associate the system-level processes listed in step 3, with the signature set you created in step 3. In the following example, this process set is called TD-Demo-system-process.
-
Create a Teradata Database process set to associate the signature set for the Teradata Database binaries created in step 4.
-
Create the user set for the Teradata trusted group on your appliance.
-
If you have any other trusted groups that you want to include in your security rule, add a user set for each one of those trusted groups. You can add as many user sets to the policy as you need.
-
Create a user set for the root user and any other privileged users you want to add.
-
Verify that you have the complete signature sets, process sets, and user sets as shown in the examples below.
-
Apply the policy to the Teradata Device GuardPoints.
