IP Filters (preview feature)

Detail name	Value
Changelog Number	9248
Type	New Feature
Status	Resolved
Fix Versions	Exasol 7.0.5
Resolution Date	2020-12-18

Background

Limiting user logins to specific IP address ranges based on database roles provides additional security options e.g. for admin roles or technical users.
Currently there is no way to archieve this

• Database user/role management allows to filter on user/roles but IP addresses cannot be filtered
• Firewalls can filter on IP addresses but cannot be configured for specific users and/or roles.

New preview feature

The new (preview) feature allows to configure allow/deny lists on IP addresses per role.
To configure the allow/deny lists, a command line parameter, named '-loginIpFilters' has been created. The parameter has a base64-encoded string value which contains a JSON-formatted list of IP filters (see below).

Note

This is a preview feature. The interface and/or functionality of this feature is subject to change in future versions.
 

IP Filters

Multiple IP filters can be created, and logins will be compared against all of them.

• One default filter can be created which functions as a basis which other role-specific filters modify. This filter does not specify any roles. It specifies if the default action is to allow or deny users if they are not specifically referenced in other role-specific filters.
• All other filters must specify one or more roles to which they apply. The rules contained in these filters override the default filter if one was provided.
• If multiple role-specific filters conflict with one another (e.g. one filter would allow a login and another would deny it), "deny" has priority.

JSON Format

• loginFilters: Array of IP filter rules.
• name: Name of the rule (for informational/logging purposes).
• roles: Array of roles to which the filter rule applies.
• defaultPolicy: Specifies the default behavior of the rule.
• allow: Array of IPs (CIDR notation) which are exceptions to the "defaultPolicy" of "deny".
• deny: Array of IPs (CIDR notation) which are exceptions to the "defaultPolicy" of "allow".

• allow: All IPs except for the ones listed in the "deny" array will be allowed.
• deny: All IPs except for the ones listed in the "allow" array will be denied.

{
    "loginFilters": [ {
        "name": <string>,
        "roles": [
            <string>
        ],
        "defaultPolicy": <"allow" | "deny">,
        // Exceptions for "defaultPolicy": "deny"
        "allow": [
            <string>
        ],
        // Exceptions for "defaultPolicy": "allow"
        "deny": [
            <string>
        ],
    } ]
}

Example

Users are allowed to connect from everywhere,
but users with admins role can only connect from to the two IP-address ranges 192.168.100.123/32 and 192.168.200.1/24

Example (using Linux commands)

1. Create a text file containing the desired IP filter rules.

# Create the file
$> vim ipFilters
# Show the file's contents
$> cat ipFilters 
{
    "loginFilters": [
        {"name": "default", "defaultPolicy": "allow"},
        {"name": "adminFilter", "defaultPolicy": "deny", "roles": ["admins"], "allow": ["192.168.100.123/32", "192.168.200.1/24"]}
    ]
}

2. Convert to base64.

$> cat ipFilters | base64 -w 0
ewogICAgImxvZ2luRmlsdGVycyI6IFsKICAgICAgICB7Im5hbWUiOiAiZGVmYXVsdCIsICJkZWZhdWx0UG9saWN5IjogImFsbG93In0sCiAgICAgICAgeyJuYW1lIjogImFkbWluRmlsdGVyIiwgImRlZmF1bHRQb2xpY3kiOiAiZGVueSIsICJyb2xlcyI6IFsiYWRtaW5zIl0sICJhbGxvdyI6IFsiMTkyLjE2OC4xMDAuMTIzLzMyIiwgIjE5Mi4xNjguMjAwLjEvMjQiXX0KICAgIF0KfQo=

3. Set the Exasol command line parameter.

-loginIpFilters=ewogICAgImxvZ2luRmlsdGVycyI6IFsKICAgICAgICB7Im5hbWUiOiAiZGVmYXVsdCIsICJkZWZhdWx0UG9saWN5IjogImFsbG93In0sCiAgICAgICAgeyJuYW1lIjogImFkbWluRmlsdGVyIiwgImRlZmF1bHRQb2xpY3kiOiAiZGVueSIsICJyb2xlcyI6IFsiYWRtaW5zIl0sICJhbGxvdyI6IFsiMTkyLjE2OC4xMDAuMTIzLzMyIiwgIjE5Mi4xNjguMjAwLjEvMjQiXX0KICAgIF0KfQo=

4. Restart Exasol and login to test the IP filters for correctness.

Additional Notes

• The administrator can lock themselves out. When using a command line parameter, this is unavoidable because Exasol doesn't know the IP address of the administrator.
• Both "allow" and "deny" lists can be provided for rules; however, it is redundant to provide an "allow" list when the "defaultPolicy" is "allow" or a "deny" list when the "defaultPolicy" is "deny".
• If the default policy is "deny" and a user's role is set to "allow" in another filter, the user will be allowed (i.e. specific role filters can override the "default" policy).
• If a user's role is denied by any non-default filter, the user will be denied even if it is allowed by other filters (i.e. "deny" has priority).
• Filtering does not work with impersonation. It is based only on the user trying to login and their respective roles.
• If a role is modified, for example, a restart of Exasol will be required for the IP filter to recognize this change.