github Download
Controls configuration on AcraServer

Controls configuration on AcraServer #

AcraServer’s security controls have the exact way of enabling/disabling and configuring them.

AcraServer can be configured from command line using CLI flags (see the whole list), or from a configuration file which should be defined as --config_file <options.yml> .

  • Data protection security controls

    There are a couple features that can only be enabled/configured in file passed in --encryptor_config_file CLI option. If you need any of these, the encryptor config is a must-have. Each feature is configured per table column (except the last one).

    • Transparent encryption — AcraServer will silently replace a plaintext with its encrypted version before storing data in the database;
    • Searchable encryption — provides searching capability over encrypted values stored in the database without decrypting them;
    • Masking — provides configurable way of partial or zero-disclosure of sensitive data to unauthorized users;
    • Tokenization — provides a format-preserving way of storing tokens (number, string, email-looking values) while the original data is stored encrypted in a dedicated separate storage (Redis).
    • Zones — allows using zone-specific keys for cryptographic operations; configured in encryptor config, but enabled with --zonemode_enable (deprecated since 0.94.0, will be removed in 0.95.0).
  • Intrusion detection

    Detecting abnormal activity of clients trying to access data they were no supposed to access.

    Enabled with --poison_detect_enable. Configured with --poison_* flags. Requires special “poison records” inserted in the database in order to have effect (example).

  • Key management

    Telling Acra where the keys are stored, so it can perform crypto-related things.

    The main key, “Acra Master Key” is read from ACRA_MASTER_KEY environment var, but can also be fetched from HashiCorp Vault or other KMS.

    Then, there are client-specific keys, AcraServer can read them from filesystem (--keys_dir) or from Redis (--redis_* flags).

  • Programmatic reactions

    Performing configured activity (i.e. running a script/binary) on some events (i.e. client attempted to read a poison record).

    Actual configuration depends on the feature you deal with.

  • Audit logging

    Ensuring that log produced by AcraServer itself is not altered/corrupted/truncated in any way.

    Enabled with --audit_log_enable. Requires additional preparation. Produced logs should be checked with acra-log-verifier.

  • SIEM/SOC integration

    Exporting logs and security events as file or by direct streaming into your SIEM/SOC software.

  • SQL firewall (aka AcraCensor)

    Protecting against SQL injections. Whitelisting/blacklisting specific queries. Logging queries.

    Enabled with --acracensor_config_file <config.yml>, which also specifies a configuration file for this specific feature.

  • Transport security

    Configuring secure connection between AcraServer and clients, between AcraServer and the database.

    For TLS, there are a plenty of --tls_* options. You can use TLS for both sides. Also, make sure you know what client ID is as it’s something Acra-related, not a part of TLS or SQL.