A newer version of this documentation is available.

View Latest

Manage Security Settings

    +
    Couchbase Server security-settings can be managed from Couchbase Web Console, and by means of the REST API.

    Couchbase Security Settings

    The basic settings for Couchbase security, available to Full and Security administrators, allow configuration of the following:

    • Users: Users can be created, given passwords, and assigned roles that allow them to access specific system resources.

    • The Root Certificate for the node, which allows the server to identify itself to clients.

    • Client Certificate settings, which determine whether a client can or must present a certificate in order to authenticate with the server.

    • Audit settings, determining which system events are audited.

    • Log Redaction settings, determining what forms of content are to be considered private, and redacted from system logs.

    • Session management setting, whereby users are logged out of Couchbase Web Console after a specified period of inactivity.

    These areas are described below.

    Access the Security Screen

    To start managing Couchbase Server security-settings, within Couchbase Web Console, access the Security screen, by means of the Security tab, on the left-hand navigation bar:

    accessSecurityScreen

    This brings up the Security screen, which appears as follows:

    securityView

    Note the tabs that run from left to right, along the upper, horizontal control-bar. These are Users, Root Certificate, Client Certificate, Audit, Log Redaction, and Session. To display the corresponding screen-content for each, left-click on the tab:

    accessUsersPanel

    Users

    The Users display (shown above) lists users currently registered on the cluster. Each user has a username and (optionally) a full name; and has one or more roles associated with them. These roles are associated with privileges that permit access to specified system-resources. The auth domain for each user can be Local or External. To add users and, in so doing, assign them roles, administrators use the ADD USER button, at the upper right.

    A full account of adding and editing users is provided in Manage Users and Roles.

    Root Certificate

    This displays the Root Certificate for the cluster:

    rootCertificateDisplay

    Initially, before any administrator-driven configuration has occurred, this is a self-signed certificate. To increase system-security, a new X.509 certificate should be created.

    See Configure Server Certificates, for further information.

    Note that the procedures for securing Cross Data Center Replication (XDCR) may involve use of the root certificate: if so, the certificate can be copied from this screen. See Secure a Replication for details.

    Client Certificate

    This displays the settings for the cluster’s handling of certificates, presented by clients attempting access:

    clientCertificateDisplay

    The user interface allows the handling of client certificates to be enabled, and optionally to be made mandatory. Note that such handling is disabled by default. The Path, Prefix, and Delimiter fields allow the specification of which details within the client certificate are to be used by the server for client-identification.

    An explanation of how to use this interface is provided in Enable Client-Certificate Handling. A detailed account of establishing client-certificate settings is provided in Configure Client Certificates.

    Audit

    This displays the audit options for the cluster:

    auditOptionsDisplay

    The options permit selection of the directory within which the audit log file is to be saved, and the frequency with which it will be rotated. Specific events can also be included in the audit process, or excluded from it.

    For further information, see Manage Auditing.

    Log Redaction

    This allows specification of whether log files should be redacted:

    logRedactionDisplay

    A redacted log file is one purged of sensitive information: this allows log files to be shared for review purposes, without private data being compromised.

    For detailed information, see Manage Logging.

    Session

    This allows sessions with Couchbase Web Console to be terminated, following a specified period of user-inactivity:

    sessionTimeoutPanel

    For information on how to use, see Manage Sessions.