Dgsecure Ondemand-Agent Installation and Configuration
Total Page:16
File Type:pdf, Size:1020Kb
DgSecure OnDemand-Agent Installation and Configuration DgSecure OnDemand – Installation and Configuration| Copyright © 2020 1 Table of Contents 1. Installation of DgSecure Agents ......................................................................................................... 3 1.1 Pre-requisites .................................................................................................................................. 3 1.2 Download Installer .......................................................................................................................... 3 1.3 Installation Steps ............................................................................................................................. 4 1.4 Add Agent to DgSecure ................................................................................................................... 5 2. Masking Grants ....................................................................................................................................... 8 2.1 Redshift ........................................................................................................................................... 8 2.2 Snowflake ........................................................................................................................................ 9 2.3 SQL Server ..................................................................................................................................... 10 2.4 Azure ............................................................................................................................................. 14 2.5 RDS ................................................................................................................................................ 15 2.5.1 MySQL ................................................................................................................................... 15 2.5.2 PostgreSQL ............................................................................................................................ 16 2.5.3 AWS ....................................................................................................................................... 17 2.5.4 Oracle .................................................................................................................................... 19 2.5.5 Aurora DB .............................................................................................................................. 24 2.5.6 Maria DB ................................................................................................................................ 24 DgSecure OnDemand – Installation and Configuration| Copyright © 2020 2 1. Installation of DgSecure Agents DgSecure OnDemand supports masking and detection on RDBMS databases, and file systems on S3. For detection of sensitive data on databases, a Detection agent must be installed, directed to the target source system. Similarly, for masking a Masker agent must be installed. Detection on S3 files system can be performed on S3 file systems can be performed using OnDemand, for this two agents S3LFA agent and Cloud agent have to be configured and installed to the target source system. The Cloud agent browses files hosted in the cloud and the S3LFA agent performs sensitive data detection on the browsed files. This document outlines how to install and configure these agents. 1.1 Pre-requisites 1. Provision an EC2 instance with the following specifications: Operating System: CentOS/RHEL 6.4 or 6.7 recommended, other Linux flavors are also supported Minimum RAM: 8 GB Minimum Hard Disc: 20 GB 2. The instance should be able to connect to the RDS or Redshift data repository which is to be scanned. 3. Java 1.7 or later is required on the EC2 instance provisioned above. 1.2 Download Installer 1. Click on the Help tab at the top panel. 2. Click on the link to the agent you want to install. DgSecure OnDemand – Installation and Configuration| Copyright © 2020 3 A zip file containing the agent installer will get downloaded. 1.3 Installation Steps On the provisioned EC2 machine, perform the following steps to install the agent: 1. Download the installer. 2. Unzip the file using the following command: For Detection agent: unzip DgSecureDiscoverIDP-<version>-linux-x64-installer.zip For Masking agent: unzip DgSecureMaskerIDP-<version>-linux-x64-installer.zip For S3LFA and Cloud agent: unzip DgSecureS3LFAIDP-<version>-linux-x64-installer.zip 3. To provide the required permissions, execute the following commands For Detection agent: chmod +x<download-directory>/DgSecureDiscoverIDP-<version>-linux-x64- installer.run sudo <download-directory>/DgSecureDiscoverIDP -<version>-linux-x64- installer.run For Masking agent: chmod +x <download-directory>/DgSecureMaskerIDP-<version>-linux-x64- installer.run sudo <download-directory>/DgSecureMaskerIDP -<version>-linux-x64- installer.run For S3LFA agent: chmod +x <directory>/DgSecureFilesIDP-<version>-linux-x64-installer.run For Cloud agent: chmod +x <directory>/DgSecureCloudIDP-<version>-linux-x64-installer.run 4. To install the required DgSecure agent, execute the following commands: For Detection agent: <directory>/DgSecureDiscoverIDP-<version>-linux-x64-installer.run For Masking agent: DgSecure OnDemand – Installation and Configuration| Copyright © 2020 4 <directory>/DgSecureMaskerIDP-<version>-linux-x64-installer.run For S3LFA agent: <directory>/DgSecureFilesIDP-<version>-linux-x64-installer.run For Cloud agent: <directory>/DgSecureCloudIDP-<version>-linux-x64-installer.run 5. Read the End User License Agreement (EULA) 6. To accept the license enter “y.” 7. Enter the path of the required installation directory. By default the installation will be done in the following directory: /opt/Dataguise 8. Skip to step 13 if you are installing a Detection or Masker agent. Select Default option to deploy Files IDP: This is the file system that you want to scan. 9. Select S3 File System: Files IDP compatible with S3 File System will be deployed for use by DgSecure. 10. Select Default value for FileSystem: The provisioned CDH5/EMR/HW cluster / Files IDP 11. Select Default value for Meta Name for S3 IDP: ‘dgsecure-test’ (case sensitive -- all lower case). 12. Select Default value for AWS Compute Region for S3 IDP: ‘us-east-1’ (case sensitive -- all lower case). 13. By default a random controller ID is generated. Replace this with ‘dataguise’ (case sensitive -- all lower case). 1.4 Add Agent to DgSecure Configure connectivity between the DgSecure server and the Agent instance. Following options are available: Install an AWS Classic Load Balancer (CLB) instance fronting the Agent, and use that IP address/hostname in the configuration. Expose the Agent IP address/hostname as a public address. Once the Agent IP address or Hostname is available, perform the following steps to configure DgSecure OnDemand: DgSecure OnDemand – Installation and Configuration| Copyright © 2020 5 1. Click on the Agents tab. 2. Click Add New Agent. 3. Provide the Agent details and save. DgSecure OnDemand – Installation and Configuration| Copyright © 2020 6 4. Once the Agent configuration is saved, the following listing will appear. The highlighted row is the configuration for the newly added Agent. 5. After adding the Agent, a source to the target database has to be added. Click on the “Sources” tab. 6. Click Add New Source. 7. Provide the target database details. Test and save the source system information. DgSecure OnDemand – Installation and Configuration| Copyright © 2020 7 2. Masking Grants DgSecure OnDemand creates a user to execute masking on the target database. The user requires certain permissions to successfully mask the data. To get these necessary permissions, the user needs to execute different grant scripts for different databases. This document outlines these grant scripts, their prerequisites and the permissions granted. DgSecure OnDemand supports the following databases: 1. Redshift 2. Snowflake 3. SQL Server 4. Azure 5. RDS MySQL PostgreSQL AWS Oracle Aurora DB Maria DB Masking grants for different database have been discussed in further sections. 2.1 Redshift i. Prerequisites To perform masking on Redshift database, the user needs to perform a set of functions. These functions are written in Python and available in a zipped file. User need to upload these to Redshift. The script reads the library and performs the masking function. Perform the following steps to upload the file containing masking functions and to create a library: 1. Download the AllFunctions.zip file from the following location: https://dg-saas.s3.amazonaws.com/MaskerPrerequisiteFiles/Scripts/redshift/AllFunctions.zip Upload the AllFunctions.zip file to the S3 storage or to a separate folder in the S3 storage. 2. To check if a library exists or not, execute the following query on the Redshift connection using psql or a similar Redshift client. Select 1 from pg_library where name = 'lib_AllFunctions'; If the above query returns result as 1, it signifies that there is an existing library. Execute the following command to drop the existing library. Drop library lib_AllFunctions; 3. Execute the following command to create a new library: CREATE LIBRARY lib_AllFunctions LANGUAGE plpythonu FROM 'https://<LOCATION OF THE ZIP FILE>/AllFunctions.zip CREDENTIALS 'aws_access_key_id=<User Name>;aws_secret_access_key=<Password>; NOTE: For more details on how to create a Redshift library, please visit: https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_LIBRARY.html