Exasol provides you with support and services through its maintenance and service packages. Standard and premium maintenance forms the basis of the services that Exasol offers you. However, the additional services such as sizing & planning, installation, operation, incident management, monitoring, or performance services can be booked as per your requirements. To know more about the support services, see Our Services.
The following sections describes the additional access that Exasol may need depending on the services you opt for.
Logs for Support
For debugging purposes Exasol support may ask for system logs. You can share the system logs with Exasol through the support system (without need of a VPN tunnel). Logs that are generated for support cases contain SQL texts and other details for SQL processes. These details are usually necessary for proper debugging. It is possible to disable SQL Texts in the log files with the database parameters "-sqltexthide=1" and "-show_statements=0". In case of coredumps, some database data from the query which was being executed could be saved.
If you opt for Exasol's managed services, VPN access is required. VPN access to the cluster and a corresponding user in EXAoperation allows Exasol Support Employees to log in to the cluster. These employees have administrative rights at the OS-level. With this access, it is possible for support employees to have indirect access to contents of the database by pulling logs or by reading the memory of processes through the OS interfaces. It is also possible that Support Employees can read certain passwords on the OS, such as the EXAoperation Disk password or passwords for a remote archive volume. In addition, Support Employees can log in to EXAoperation and view the configuration of the cluster and are also able to pull logs, when needed. Within the logs, SQL text is visible.
To know about what is required for the VPN access, see Configure VPN Tunnel Access for Support.
If Exasol needs VPN access to your system for any of its managed service, the database access may also be required. In this case, you have to grant Exasol access to the database by creating a debug user which has limited access to the database. This user is granted the permission SELECT ANY DICTIONARY, which grants read-only access to the contents of every system table in the SYS and EXA_STATISTICS schema. This includes data models, script text, table columns, etc even if the user does not have access to the objects themselves. All system tables are mapped to internal tables and views, which are owned by the user SYS. This cannot be changed. Therefore, it is impossible to grant table-specific privileges or limit what information can be viewed within the SYS and EXA_STATISTICS schema.
If auditing is enabled for the database, the auditing tables in the EXA_STATISTICS schema will also contain SQL statements which are run on the database. Exasol debug users do not have direct access to the data located in other schemas.
You need to run the following command to create the exa_debug user.
CREATE USER exa_debug IDENTIFIED BY "secure password"; GRANT CREATE SESSION TO exa_debug; GRANT SELECT ANY DICTIONARY TO exa_debug; GRANT EXPORT TO exa_debug;
After the installation of the cluster, Exasol will handover the credentials of the SYS user to the customer with the requirement to change the password. After this point in time, Exasol does not have access to this user and will not be able to login to the database. Instead, Exasol uses the debug user that is described in the section above.
Additional Requirements for Monitoring
If you opt for Exasol's monitoring services, you need to provide an additional port. To know about the network requirements, see Configure VPN Tunnel Access for Support. To know about monitoring, see Create Monitoring Services.
Root Access Through Private Key
You can use SSH keys as a secure way of logging into a server instead of using a username and password. An SSH key pair contains private and public keys. Keep the Private key safe and secure and only share the public key.
Do the following to create SSH keys and place them to a destination host:
- Run the following command to create the keys:
ssh-keygen -t rsa
- Specify location and password, or choose default settings.
- Contact Exasol Support to add the keys to a destination host (Exasol cluster).