Network security access control

OceanBase Database allows you to implement network security access control based on allowlist policies. You can use the tenant allowlist feature to allow only specific clients to access a tenant.

The tenant allowlist is controlled through the system variable ob_tcp_invited_nodes, which is a global allowlist parameter for the tenant. The default value is 127.0.0.1,::1, which means that only the local IP address is allowed to connect to the tenant. This variable supports a list of values separated by commas, for example: A,B,C,D. When a user logs on to an OBServer node, the OBServer node will verify the user's IP address against the values A, B, C, and D. If the user's IP address matches none of them, the access is denied. If it matches any of them, the user is granted access through the allowlist.

You can specify the values in the following formats:

• Regular IP addresses, for example: 192.168.1.1. Access is allowed when an exact match occurs, namely, the IP address of the client is identical to the specified value.
• IP addresses that contain a percent sign (%) or underscores (_), for example: 192.168.1.% or 192.168.1._. Access is allowed when a fuzzy match occurs, which is similar to the LIKE operator.
• IP addresses that contain a network mask, for example: 192.168.1.0/24 or 192.168.1.0/255.255.255.0. Access is allowed when a mask match occurs, namely, the Client_IP & NetMask equals the specified value.

View and set a tenant allowlist

1. Log in to the sys tenant as the root user.

   obclient -uroot@sys -P2881 -h10.xxx.xxx.1 -p*******
   

2. Execute the following statement to view the tenant allowlist:

   obclient> SHOW VARIABLES LIKE 'ob_tcp_invited_nodes';
   +----------------------+-------+
   | Variable_name        | Value |
   +----------------------+-------+
   | ob_tcp_invited_nodes | %     |
   +----------------------+-------+
   

   Here, % indicates that any client IP is allowed to connect to the tenant.

3. To modify the allowlist, execute the following statements.

   Here is an example:

   obclient> SET GLOBAL ob_tcp_invited_nodes='%';
   
   obclient> SET GLOBAL ob_tcp_invited_nodes='10.10.10.%';