Keep Your Database Secure With Percona Advisors

Keep Your Database Secure With Percona Advisors

The definition of Percona Advisors by ChatGPT is the following:

Percona Advisors can help organizations implement robust security measures to protect their databases and sensitive data.

It is partially true. The reason why we have Percona Advisors is to encode years of our database expertise and share it with the community, to resolve performance and security issues automatically, without human intervention.

Percona Advisors is an open source framework, meaning you can create your own checks by following our documentation. Right now even if you create your own advisors, they will overwrite existing Percona checks. So it is only for debugging and testing purposes. We plan to extend the framework to enable innovation and contributions from the community. By default Percona Monitoring and Management (PMM) comes with basic advisor checks, whereas registered and paid tiers get much more. See more about it on our subscription page.

In this blog post, I will show how Percona Advisors work and demonstrate various checks in action.

Preparation

Percona Monitoring and Management (PMM)

Install PMM by following the documentation. I will deploy it on my Kubernetes cluster with the helm chart.

Create your Percona Platform account

Navigate to https://portal.percona.com to create an account if you don’t have one already. By just creating an account you will get access to more advisors for free, whereas I myself on a paid tier enjoy the full power of sophisticated checks.

This is the number of checks that PMM has by default right after installation:

Once PMM is connected to the Platform, PMM downloads advisors automatically. With the paid subscription I get the following list:

Register PMM in the Platform

The process of registering PMM in the Platform is described in the documentation. In short:

1. Fetch the token from https://portal.percona.com/profile
2. Add this token in the PMM Settings -> Percona Platform section.

Action

Checks in action

I will deploy a MySQL cluster with Group Replication and monitor it with PMM. For the sake of simplicity and speed, I will use Percona Operator for MySQL (based on Percona Server for MySQL which is in tech preview).

As a result, I see the following checks firing up:

For example “Passwords don’t expire, as default_password_lifetime=0” checks alerts that the password expiration is not enabled:

Please consider imposing an expiry time for passwords by setting default_password_lifetime to a positive integer, indicating how many days can go by before the user has to renew their password; This will help prevent brute force attacks and risks of data leaks.

Embed checks in your CICD pipeline

With PMM API you can easily automate database compliance checks with your existing CICD pipelines.

Get all the services with failed checks:

Now get all the failed checks for a specific service:

This is the example of a summary of one check:

Conclusion

Day-2 operations for databases are complex. Keeping your database secure and performant before it is too late can be achieved without human intervention.  In this blog post, we showed how Percona Advisors can help with it.

Try PMM Now