OGG security Features: Using CMDSEC for permission control

Iv. using CMDSEC to control the rights

Goldengate can restrict the use of commands by some users. For example, you can allow some monitoring users to use only the info and STAT commands and not allow them to use the start and stop commands, which is limited to the operating system user group and now restricts the use of commands.

Goldengate use by creating a file in the installation directory and adding some rules to the file to control the user's use of the command, each row of rules, the order of the rules from the widest range of control to the least range from top to bottom, each rule to be separated by a space. The writing rules are formatted as follows:

Example 21:

<command name> <command object> <os group> <os user> <yes | No>

An explanation of each option:

<command Name>: is a goldengate command or a wildcard character, such as Start, stop, *.

<command Object>: Is the goldengate process group type or wildcard character, such as extract, Replicat, MGR.

<os Group>: Is the operating system user group, the user ID can be substituted for the user name under UNIX, or the * is used to represent all user groups.

<yes | No>: Indicates whether this command is open to or prohibited by this user.

The following is a simple case of controlling a user's use of commands under a Linux system:

Example 22:

#GG command Line

Status Replicat * Smith no--does not allow Smith to use status command at disaster-tolerant end

Status * DPT1 * YES-except for the above rules, all users under the DPT1 group can use the status command

Users under Start replicat root * yes--root Group can use the start replicat command

Start Replicat * * No-except for the rules above, all users cannot use the start replicat command

* EXTRACT * No--group with ID 200 are not allowed to use commands at the production end

* * Root root YES--root user can use any command

* * * * no-except for the above rules, all users are not allowed to use the goldengate command

The Cmdsec file is the source of command-line security and must be secured to give users permission to read it, but not to allow all users except Goldengate administrators to modify and delete the file.

More Wonderful content: http://www.bianceng.cnhttp://www.bianceng.cn/database/extra/