How to Secure PostgreSQL Managed Database Clusters

Validated on 8 Aug 2019 • Posted on 14 Feb 2019

PostgreSQL is an open source, object-relational database built with a focus on extensibility, data integrity, and speed. Its concurrency support makes it fully ACID-compliant, and it supports dynamic loading and catalog-driven operations to let users customize its data types, functions, and more.

Data in PostgreSQL database clusters is encrypted at rest with LUKS (Linux Unified Key Setup) and in transit with SSL. However, there are additional steps you can take to ensure that your data is safe.

Restrict Incoming Connections

You can greatly decrease the likelihood of a security breach by restricting which DigitalOcean resources or external IP addresses are allowed to access the nodes in a cluster. This prevents brute force password and denial-of-service attacks from any server not explicitly permitted to connect.

Typically, only the application servers are allowed to connect to the database cluster. Users access the public-facing site, and the public-facing server authenticates and manages database connections in turn.

Add a Trusted Source Using the CLI

How to add a trusted source using the DigitalOcean CLI

To add a trusted source via the command-line, follow these steps:

Install doctl, the DigitalOcean command-line tool.
Create a personal access token, and save it for use with doctl.
Use the token to grant doctl access to your DigitalOcean account.
```
              doctl auth init
            
```
Finally, add a trusted source with doctl databases firewalls append. The basic usage looks like this, but you'll want to read the usage docs for more details:
```
              doctl databases firewalls append <db-id> --rule type:value [flags]
            
```

Add a Trusted Source Using the API

How to add or remove a trusted source using the DigitalOcean API

To add or remove a trusted source using the DigitalOcean API, follow these steps:

Create a personal access token, and save it for use with the API.

Send a PUT request to https://api.digitalocean.com/v2/databases/{database_cluster_uuid}/firewall

cURL

To add or remove a trusted source with cURL, call:


                curl -X PUT \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"rules": [{"type": "ip_addr","value": "192.168.1.1"},{"type": "droplet","value": "163973392"},{"type": "k8s","value": "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61"},{"type": "tag","value": "backend"]}' \
  "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30/firewall"

Go

Go developers can use Godo, the official DigitalOcean V2 API client for Go. To add or remove a trusted source with Godo, use the following code:


                import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    req := godo.DatabaseUpdateFirewallRulesRequest{
      Rules: []*godo.DatabaseFirewallRule{
        {
         Type:  "ip_addr",
         Value: "192.168.1.1",
       },
        {
         Type:  "droplet",
         Value: "163973392",
       },
        {
         Type:  "k8s",
         Value: "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61",
        },
      },
    }
    _, err := client.Databases.UpdateFirewallRules(ctx, dbID, &req)
}

Add a Trusted Source using the Control Panel

To restrict access to a database cluster, click the name of the cluster in the control panel to go to its Overview page, then click the Settings tab.

In the section titled Trusted Sources, click Edit to open the Add trusted sources text box.

The open Trusted Sources section of the settings page

You can enter Droplets, Kubernetes clusters, tags, apps, or specific IP addresses. Entering a tag provides access to the database for any Droplets or Kubernetes nodes containing that tag. At this time, DigitalOcean Cloud Firewalls are not supported.

Increase the SSL Mode Verification Level

By default, you must use SSL to transmit data because it prevents eavesdropping on administrative usernames and passwords as well as the data itself as it is transmitted. However, SSL doesn’t protect against man-in-the-middle (MITM) attacks or impersonation.

You can enable the verify-ca and verify-full SSL modes for PostgreSQL to check for these attacks. They’re disabled by default because they can affect performance.

To enable verify-ca or verify-full, update the value for sslmode in the --set flag when connecting. For example, to connect using the verify-full option, your connection string would look like this:

PGPASSWORD=paakjnfe10rsrsmf psql -U doadmin -h source-do-user-6607903-0.b.db.ondigitalocean.com -p 25060 -d defaultdb --set=sslmode=verify-full

Learn more in the PostgreSQL documentation on SSL support.