Using CTE with an EnterpriseDB Postgres Advanced Server

This document describes how to integrate CTE with an EnterpriseDB (EDB) Postgres Advanced Server.

Test Environment

• CTE Agent: 7.2.0.128

• CipherTrust Manager: 2.9.0

• OS: RHEL 7.9

• EDB Postgres Advanced Server: 14.5

• File System: XFS

Steps

To integrate CTE with an EnterpriseDB Postgres Advanced Server:

1. Install the Prerequisite Packages

2. Install and Configure the EDB Postgres Advanced Server

3. Install and Register the CTE Agent

4. Integrate EDB with CTE

5. Create the GuardPoints

Install the Prerequisite Packages

Install the prerequisite packages by performing the following steps on the client machine.

1. Log on to the SSH client.

2. Run this command.

   yum -y install   https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

   Copy

Now you can install the EDB Postgres Advanced Server.

Install and Configure the EDB Postgres Advanced Server

Before starting the installation and configuration, ensure that the client machine is already registered with the RHEL. Perform the following steps.

1. Log on to the EDB.

2. Go to the EDB Profile section and copy the EDB repository credentials.

3. On the SSH client, install the repository configuration package.

   yum -y install https://yum.enterprisedb.com/edbrepos/edb-repo-latest.noarch.rpm

   Copy

4. Update the credentials in /etc/yum.repos.d/edb.repo file with the copied credentials.

   sed -i "s@<username>:<password>@john:Kh0kVuJg7Wg60Gn1@" /etc/yum.repos.d/edb.repo

   Copy

5. Install the EDB Postgres Advanced Server.

   yum -y install edb-as14-server

   Copy

   Output:

   Installed:
   edb-as14-server.x86_64 0:14.5.0-1.rhel7
   
   Dependency Installed:
   edb-as14-pgagent.x86_64 0:4.2.2-1.rhel7                        edb-as14-server-client.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-cloneschema.x86_64 0:1.16-1.rhel7              edb-as14-server-contrib.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-core.x86_64 0:14.5.0-1.rhel7                   edb-as14-server-devel.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-docs.x86_64 0:14.5.0-1.rhel7                   edb-as14-server-indexadvisor.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-libs.x86_64 0:14.5.0-1.rhel7                   edb-as14-server-llvmjit.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-parallel-clone.x86_64 0:1.9-1.rhel7            edb-as14-server-pldebugger.x86_64 0:1.1-1.rhel7
   edb-as14-server-plperl.x86_64 0:14.5.0-1.rhel7                 edb-as14-server-plpython3.x86_64 0:14.5.0-1.rhel7
   edb-as14-server-pltcl.x86_64 0:14.5.0-1.rhel7                  edb-as14-server-sqlprofiler.x86_64 0:4.0-1.rhel7
   edb-as14-server-sqlprotect.x86_64 0:14.5.0-1.rhel7             edb-as14-server-sslutils.x86_64 0:1.3-1.rhel7
   Complete!

   Copy
   

   Note

   An enterprisedb user will be created.

6. Initialize the database cluster.

   PGSETUP_INITDB_OPTIONS="-E UTF-8" /usr/edb/as14/bin/edb-as-14-setup initdb

   Copy

7. Start the database server.

   systemctl start edb-as-14

   Copy

8. Connect to the database server.

9. As the enterprisedb user, open a psql session.

   sudo su - enterprisedb
   /usr/edb/as14/bin/psql -d edb -p 5444

   Copy
   

   Note

   Now, you can create a database with tables and enter data in the tables, using the simple SQL commands.

10. Ensure that the Database server is running.

    /usr/edb/as14/bin/pg_ctl status -D /var/lib/edb/as14/data

    Copy

    Output:

    -bash-4.2$ /usr/edb/as14/bin/pg_ctl status -D /var/lib/edb/as14/data
    pg_ctl: server is running (PID: 43002)
    /usr/edb/as14/bin/edb-postgres "-D" "/var/lib/edb/as14/data"

    Copy

Install and Register the CTE Agent

1. Install the CTE Agent on the client machine where the EDB Postgres Advanced Server is installed and configured.

2. Register the CTE Agent with the CipherTrust Manager.

Refer to CTE - Agent Quick Start Guide for details.

Integrate EDB with CTE

On the SSH client, perform the following steps.

1. As a super (root) user, stop the EDB server.

   systemctl stop edb-as-14

   Copy

2. Update the edb-as-14.service file.

   1. Navigate to /lib/systemd/system/.

   2. Open edb-as-14.service in a text editor.

   3. Below the Unit section, add the following line.

      Requires=secfs-fs-barrier.service

      Copy

   4. Save the change and close the file.

3. Update the secfs-fs-barrier.service file.

   1. Navigate to /lib/systemd/system/.

   2. Open secfs-fs-barrier.service in a text editor.

   3. At the end of the Before section, add the following line.

      edb-as-14.service

      Copy

   4. Save the change and close the file.

4. Reboot the system.

5. Stop the EDB server.

6. Restart the SecFS.

7. Start the EDB server again.

The setup is ready, now you can guard the EDB data and log directories.

Create the GuardPoints

Perform the following steps on the CTE client.

1. On the CTE client, stop the EDB server.

2. On the CipherTrust Manager, create the GuardPoints. While creating the GuardPoint:

   • Enter the Path of the data and log directories that are /var/lib/edb/as14/data and /var/log/edb/as14.

   • Select the Policy Type, you can select it either as Standard or Live Data Transformation (LDT).

   • Create a User Set with users root and enterprisedb, and give them the permission to perform all Actions and Effects.

   Refer to Creating GuardPointsfor details.

3. Once the policy is enabled, start the EDB server.