diff --git a/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_java.md b/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_java.md index 0499a85..874823d 100644 --- a/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_java.md +++ b/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_java.md @@ -108,7 +108,7 @@ See the *WarehousePG Reference Guide* for information about the WarehousePG serv PL/Java requires a Java runtime environment on each WarehousePG host. Ensure that the same Java environment is at the same location on all hosts: masters and segments. The command `java -version` displays the Java version. -The commands that you use to install Java depend on the host system operating system and Java version. This list describes how to install OpenJDK 8 or 11 (Java 8 JDK or Java 11 JDK) on RHEL/CentOS or Ubuntu. +The commands that you use to install Java depend on the host system operating system and Java version. This list describes how to install OpenJDK 8 or 11 (Java 8 JDK or Java 11 JDK) on RHEL/CentOS. - RHEL 7/CentOS 7 - This `yum` command installs OpenJDK 8 or 11. @@ -142,23 +142,12 @@ The commands that you use to install Java depend on the host system operating sy The second command returns some `failed to read link` errors that can be ignored. -- Ubuntu - These `apt` commands install OpenJDK 8 or 11. - - ``` - $ sudo apt update - $ sudo apt install openjdk--jdk - ``` - - For OpenJDK 8 the version is `8`, for OpenJDK 11 the version is `11`. - After installing OpenJDK on a RHEL or CentOS system, run this `update-alternatives` command to change the default Java. Enter the number that represents the OpenJDK version to use as the default. ``` $ sudo update-alternatives --config java ``` -The `update-alternatives` command is not required on Ubuntu systems. - > **Note** When configuring host systems, you can use the [gpssh](../../../ref_guide/utility_guide/reference/gpssh.md) utility to run bash shell commands on multiple remote hosts. diff --git a/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_r.md b/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_r.md index 0ff0263..111a778 100644 --- a/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_r.md +++ b/docs/whpg/6x/admin_guide/analytics/procedural_languages/pl_r.md @@ -30,8 +30,6 @@ For information about supported PL/R versions, see the *WarehousePG Release Note For RHEL and CentOS, installing the PL/R package installs R in `$GPHOME/ext/R-` and updates `$GPHOME/greenplum_path.sh` for WarehousePG to use R. -To use PL/R on Ubuntu host systems, you must install and configure R on all WarehousePG host systems before installing PL/R. - > **Note** You can use the [gpssh](../../../ref_guide/utility_guide/reference/gpssh.md) utility to run bash shell commands on multiple remote hosts. 1. To install R, run these `apt` commands on all host systems. @@ -106,7 +104,6 @@ PL/R is registered as an untrusted language. - [Remove PL/R Support for a Database](#topic7) - [Uninstall the Extension Package](#topic8) -- [Uninstall R (Ubuntu)](#topic_ifv_tsf_w3b) When you remove PL/R language support from a database, the PL/R routines that you created in the database will no longer work. @@ -130,27 +127,6 @@ If no databases have PL/R as a registered language, uninstall the WarehousePG PL On RHEL and CentOS systems, uninstalling the extension uninstalls the R software that was installed with the extension. -For Ubuntu systems, remove the `R_HOME` environment variable from `greenplum_path.sh` on all WarehousePG host systems. - -Source the file `$GPHOME/greenplum_path.sh` and restart the database. - -``` -$ gpstop -r -``` - - - -#### Uninstall R (Ubuntu) - -For Ubuntu systems, remove R from all WarehousePG host systems. These commands remove R from an Ubuntu system. - -``` -$ sudo apt remove r-base -$ sudo apt remove r-base-core -``` - -Removing `r-base` does not uninstall the R executable. Removing `r-base-core` uninstalls the R executable. - ### Examples diff --git a/docs/whpg/6x/admin_guide/manage_access/client_auth/index.md b/docs/whpg/6x/admin_guide/manage_access/client_auth/index.md index 8e8922b..d7efdd8 100644 --- a/docs/whpg/6x/admin_guide/manage_access/client_auth/index.md +++ b/docs/whpg/6x/admin_guide/manage_access/client_auth/index.md @@ -40,107 +40,19 @@ local   database   role   authentication-method The following table describes meaning of each field. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Table 1. pg_hba.conf Fields
FieldDescription
localMatches connection attempts using UNIX-domain sockets. Without a - record of this type, UNIX-domain socket connections are disallowed.
hostMatches connection attempts made using TCP/IP. Remote TCP/IP - connections will not be possible unless the server is started with an appropriate - value for the listen_addresses server configuration - parameter.
hostsslMatches connection attempts made using TCP/IP, but only when the - connection is made with SSL encryption. SSL must be enabled at server start time by - setting the ssl server configuration parameter.
hostnosslMatches connection attempts made over TCP/IP that do not use - SSL.
databaseSpecifies which database names this record matches. The value - all specifies that it matches all databases. Multiple database - names can be supplied by separating them with commas. A separate file containing - database names can be specified by preceding the file name with a - @.
roleSpecifies which database role names this record matches. The - value all specifies that it matches all roles. If the specified - role is a group and you want all members of that group to be included, precede the - role name with a +. Multiple role names can be supplied by - separating them with commas. A separate file containing role names can be specified - by preceding the file name with a @.
addressSpecifies the client machine addresses that this record matches. - This field can contain an IP address, an IP address range, or a host name.

An IP - address range is specified using standard numeric notation for the range's - starting address, then a slash (/) and a CIDR mask length. The - mask length indicates the number of high-order bits of the client IP address that - must match. Bits to the right of this should be zero in the given IP address. - There must not be any white space between the IP address, the /, - and the CIDR mask length.

Typical examples of an IPv4 address range - specified this way are 172.20.143.89/32 for a single host, or - 172.20.143.0/24 for a small network, or - 10.6.0.0/16 for a larger one. An IPv6 address range might look - like ::1/128 for a single host (in this case the IPv6 loopback - address) or fe80::7a31:c1ff:0000:0000/96 for a small network. - 0.0.0.0/0 represents all IPv4 addresses, and - ::0/0 represents all IPv6 addresses. To specify a single host, - use a mask length of 32 for IPv4 or 128 for IPv6. In a network address, do not - omit trailing zeroes.

An entry given in IPv4 format will match only IPv4 - connections, and an entry given in IPv6 format will match only IPv6 connections, - even if the represented address is in the IPv4-in-IPv6 range. -
Note: Entries in IPv6 format will be rejected if the host system C library does - not have support for IPv6 addresses.

If a host name is specified - (an address that is not an IP address or IP range is treated as a host name), that - name is compared with the result of a reverse name resolution of the client IP - address (for example, reverse DNS lookup, if DNS is used). Host name comparisons - are case insensitive. If there is a match, then a forward name resolution (for - example, forward DNS lookup) is performed on the host name to check whether any of - the addresses it resolves to are equal to the client IP address. If both - directions match, then the entry is considered to match.

Some host name - databases allow associating an IP address with multiple host names, but the - operating system only returns one host name when asked to resolve an IP address. - The host name that is used in pg_hba.conf must be the one that - the address-to-name resolution of the client IP address returns, otherwise the - line will not be considered a match.

When host names are specified in - pg_hba.conf, you should ensure that name resolution is - reasonably fast. It can be of advantage to set up a local name resolution cache - such as nscd. Also, you can enable the server configuration - parameter log_hostname to see the client host name instead of the - IP address in the log.

IP-address

IP-mask

These fields can be used as an alternative to the CIDR address - notation. Instead of specifying the mask length, the actual mask is specified in a - separate column. For example, 255.0.0.0 represents an IPv4 CIDR - mask length of 8, and 255.255.255.255 represents a CIDR mask length - of 32.
authentication-methodSpecifies the authentication method to use when connecting. - WarehousePG supports the authentication methods supported by PostgreSQL 9.4.
+**Table 1. pg_hba.conf Fields** + +| Field | Description | +|-------|--------------| +| `local` | Matches connection attempts using UNIX-domain sockets. Without a record of this type, UNIX-domain socket connections are disallowed. | +| `host` | Matches connection attempts made using TCP/IP. Remote TCP/IP connections aren't possible unless the server starts with an appropriate value for the `listen_addresses` server configuration parameter. | +| `hostssl` | Matches connection attempts made using TCP/IP, but only when the connection is made with SSL encryption. SSL must be enabled at server start time by setting the `ssl` server configuration parameter. | +| `hostnossl` | Matches connection attempts made over TCP/IP that don't use SSL. | +| `database` | Specifies which database names this record matches. The value `all` specifies that it matches all databases. Multiple database names can be supplied by separating them with commas. A separate file containing database names can be specified by preceding the file name with a `@`. | +| `role` | Specifies which database role names this record matches. The value `all` specifies that it matches all roles. If the specified role is a group and you want all members of that group included, precede the role name with a `+`. Multiple role names can be supplied by separating them with commas. A separate file containing role names can be specified by preceding the file name with a `@`. | +| `address` | Specifies the client machine addresses that this record matches. This field can contain an IP address, an IP address range, or a host name.

An IP address range is specified using standard numeric notation for the range's starting address, then a slash (`/`) and a CIDR mask length. The mask length indicates the number of high-order bits of the client IP address that must match. Bits to the right of this mask length must be zero in the given IP address. There must not be any white space between the IP address, the `/`, and the CIDR mask length.

Typical examples of an IPv4 address range specified this way are `172.20.143.89/32` for a single host, `172.20.143.0/24` for a small network, or `10.6.0.0/16` for a larger one. An IPv6 address range might look like `::1/128` for a single host (in this case the IPv6 loopback address) or `fe80::7a31:c1ff:0000:0000/96` for a small network. `0.0.0.0/0` represents all IPv4 addresses, and `::0/0` represents all IPv6 addresses. To specify a single host, use a mask length of 32 for IPv4 or 128 for IPv6. In a network address, don't omit trailing zeroes.

An entry given in IPv4 format matches only IPv4 connections, and an entry given in IPv6 format matches only IPv6 connections, even if the represented address is in the IPv4-in-IPv6 range. **Note** Entries in IPv6 format are rejected if the host system C library doesn't support IPv6 addresses.

If a host name is specified (an address that isn't an IP address or IP range is treated as a host name), that name is compared with the result of a reverse name resolution of the client IP address (for example, reverse DNS lookup, if DNS is used). Host name comparisons are case insensitive. If there's a match, then a forward name resolution (for example, forward DNS lookup) is performed on the host name to check whether any of the addresses it resolves to are equal to the client IP address. If both directions match, the entry is considered a match.

Some host name databases allow associating an IP address with multiple host names, but the operating system only returns one host name when asked to resolve an IP address. The host name used in `pg_hba.conf` must be the one that the address-to-name resolution of the client IP address returns, otherwise the line isn't considered a match.

When host names are specified in `pg_hba.conf`, make sure that name resolution is reasonably fast. Setting up a local name resolution cache such as `nscd` can help. You can also enable the server configuration parameter `log_hostname` to see the client host name instead of the IP address in the log. | +| `IP-address`
`IP-mask` | These fields can be used as an alternative to the CIDR address notation. Instead of specifying the mask length, the actual mask is specified in a separate column. For example, `255.0.0.0` represents an IPv4 CIDR mask length of 8, and `255.255.255.255` represents a CIDR mask length of 32. | +| `authentication-method` | Specifies the authentication method to use when connecting. WarehousePG supports the [authentication methods](https://www.postgresql.org/docs/9.4/auth-methods.html) supported by PostgreSQL 9.4. | > **Caution** For a more secure system, consider removing records for remote connections that use trust authentication from the `pg_hba.conf` file. Trust authentication grants any user who can connect to the server access to the database using any role they specify. You can safely replace trust authentication with ident authentication for local UNIX-socket connections. You can also use ident authentication for local and remote TCP clients, but the client host must be running an ident service and you must trust the integrity of that machine. @@ -292,6 +204,23 @@ gpconfig -c ssl -m on -v off Setting the parameter requires a server restart. This command restarts the system: `gpstop -ra`. + + +### Negotiating TLS Version Automatically + +WarehousePG negotiates the highest TLS protocol version that both the client and the coordinator support. When both endpoints run OpenSSL 1.1.1 or later, connections use TLS 1.3 automatically, with no additional configuration required. + +Confirm the negotiated version for a connection with the `ssl_version()` function, available after you create the `sslinfo` extension: + +``` +psql -d testdb -c 'CREATE EXTENSION sslinfo;' +psql -d testdb -c 'SELECT ssl_version();' +``` + +::: info Note +The `pg_stat_ssl` system view, which reports the negotiated TLS version and cipher for each connection, is not available in WarehousePG 6 because WarehousePG 6 is based on PostgreSQL 9.4, and the view was introduced in a later PostgreSQL release. +::: + ### Creating a Self-signed Certificate without a Passphrase for Testing Only @@ -299,7 +228,7 @@ Setting the parameter requires a server restart. This command restarts the syste To create a quick self-signed certificate for the server for testing, use the following OpenSSL command: ``` -# openssl req -new -text -out server.req +openssl req -new -text -out server.req ``` @@ -310,8 +239,8 @@ The program will generate a key that is passphrase protected, and does not accep To use this certificate with WarehousePG, remove the passphrase with the following commands: ``` -# openssl rsa -in privkey.pem -out server.key -# rm privkey.pem +openssl rsa -in privkey.pem -out server.key +rm privkey.pem ``` Enter the old passphrase when prompted to unlock the existing key. @@ -319,13 +248,13 @@ Enter the old passphrase when prompted to unlock the existing key. Then, enter the following command to turn the certificate into a self-signed certificate and to copy the key and certificate to a location where the server will look for them. ``` -# openssl req -x509 -in server.req -text -key server.key -out server.crt +openssl req -x509 -in server.req -text -key server.key -out server.crt ``` Finally, change the permissions on the key with the following command. The server will reject the file if the permissions are less restrictive than these. ``` -# chmod og-rwx server.key +chmod og-rwx server.key ``` For more details on how to create your server private key and certificate, refer to the [OpenSSL documentation](https://www.openssl.org/docs/). diff --git a/docs/whpg/6x/install_guide/config_os.md b/docs/whpg/6x/install_guide/config_os.md index 6514e81..3a38b03 100644 --- a/docs/whpg/6x/install_guide/config_os.md +++ b/docs/whpg/6x/install_guide/config_os.md @@ -63,7 +63,7 @@ If you choose to enable SELinux in `Enforcing` mode, then WarehousePG processes ## Deactivate or Configure Firewall Software -You should also deactivate firewall software such as `iptables` (on systems such as RHEL 6.x and CentOS 6.x ), `firewalld` (on systems such as RHEL 7.x and CentOS 7.x and later), or `ufw` (on Ubuntu systems, deactivated by default). If firewall software is not deactivated, you must instead configure your software to allow required communication between WarehousePG hosts. +You should also deactivate firewall software such as `iptables` (on systems such as RHEL 6.x and CentOS 6.x) or `firewalld` (on systems such as RHEL 7.x and CentOS 7.x and later). If firewall software is not deactivated, you must instead configure your software to allow required communication between WarehousePG hosts. To deactivate `iptables`: @@ -344,7 +344,7 @@ XFS is the preferred data storage file system on Linux platforms. Use the `mount rw,nodev,noatime,nobarrier,inode64 ``` -The `nobarrier` option is not supported on RHEL 8 or Ubuntu systems or later. Use only the options: +The `nobarrier` option is not supported on RHEL 8 systems or later. Use only the options: ``` rw,nodev,noatime,inode64 @@ -425,7 +425,7 @@ The XFS options can also be set in the `/etc/fstab` file. This example entry fro Non-Volatile Memory Express (NVMe) - RHEL 7
RHEL 8
RHEL 9
Ubuntu + RHEL 7
RHEL 8
RHEL 9 none @@ -434,7 +434,7 @@ The XFS options can also be set in the `/etc/fstab` file. This example entry fro noop - RHEL 8
RHEL 9
Ubuntu + RHEL 8
RHEL 9 none @@ -443,7 +443,7 @@ The XFS options can also be set in the `/etc/fstab` file. This example entry fro deadline - RHEL 8
RHEL 9
Ubuntu + RHEL 8
RHEL 9 mq-deadline @@ -479,7 +479,7 @@ The XFS options can also be set in the `/etc/fstab` file. This example entry fro Refer to your operating system documentation for more information about the `grubby` utility. If you used the `grubby` command to configure the disk scheduler on a RHEL or CentOS 7.x system and later and it does not update the kernels, see the [Note](#grubby_note) at the end of the section. - For additional information about configuring the disk scheduler, refer to the RedHat Enterprise Linux documentation for [RHEL 7](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/performance_tuning_guide/sect-red_hat_enterprise_linux-performance_tuning_guide-storage_and_file_systems-configuration_tools#sect-Red_Hat_Enterprise_Linux-Performance_Tuning_Guide-Configuration_tools-Setting_the_default_IO_scheduler), [RHEL 8](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/monitoring_and_managing_system_status_and_performance/setting-the-disk-scheduler_monitoring-and-managing-system-status-and-performance), or [RHEL 9](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/monitoring_and_managing_system_status_and_performance/setting-the-disk-scheduler_monitoring-and-managing-system-status-and-performance). The Ubuntu wiki [IOSchedulers](https://wiki.ubuntu.com/Kernel/Reference/IOSchedulers) topic describes the I/O schedulers available on Ubuntu systems. + For additional information about configuring the disk scheduler, refer to the RedHat Enterprise Linux documentation for [RHEL 7](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/performance_tuning_guide/sect-red_hat_enterprise_linux-performance_tuning_guide-storage_and_file_systems-configuration_tools#sect-Red_Hat_Enterprise_Linux-Performance_Tuning_Guide-Configuration_tools-Setting_the_default_IO_scheduler), [RHEL 8](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/monitoring_and_managing_system_status_and_performance/setting-the-disk-scheduler_monitoring-and-managing-system-status-and-performance), or [RHEL 9](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/monitoring_and_managing_system_status_and_performance/setting-the-disk-scheduler_monitoring-and-managing-system-status-and-performance). @@ -518,12 +518,6 @@ On systems that use `grub2` such as RHEL 7.x or CentOS 7.x and later, use the sy After adding the parameter, reboot the system. -For Ubuntu systems, install the `hugepages` package and run this command as root: - -``` -# hugeadm --thp-never -``` - This cat command checks the state of THP. The output indicates that THP is deactivated. ``` @@ -537,7 +531,7 @@ For more information about Transparent Huge Pages or the `grubby` utility, see y ### IPC Object Removal -Deactivate IPC object removal for RHEL 7.2 or CentOS 7.2, or Ubuntu. The default `systemd` setting `RemoveIPC=yes` removes IPC connections when non-system user accounts log out. This causes the WarehousePG utility `gpinitsystem` to fail with semaphore errors. Perform one of the following to avoid this issue. +Deactivate IPC object removal for RHEL 7.2 or CentOS 7.2. The default `systemd` setting `RemoveIPC=yes` removes IPC connections when non-system user accounts log out. This causes the WarehousePG utility `gpinitsystem` to fail with semaphore errors. Perform one of the following to avoid this issue. - When you add the `gpadmin` operating system user account to the coordinator node in [Creating the WarehousePG Administrative User](#topic23), create the user as a system account. - Deactivate `RemoveIPC`. Set this parameter in `/etc/systemd/logind.conf` on the WarehousePG host systems. @@ -700,7 +694,7 @@ The following steps show how to set up the `gpadmin` user on a host, set a passw 1. Create the `gpadmin` group and user. - > **Note** If you are installing WarehousePG on RHEL 7.2 or CentOS 7.2 and want to deactivate IPC object removal by creating the `gpadmin` user as a system account, provide both the `-r` option (create the user as a system account) and the `-m` option (create a home directory) to the `useradd` command. On Ubuntu systems, you must use the `-m` option with the `useradd` command to create a home directory for a user. + > **Note** If you are installing WarehousePG on RHEL 7.2 or CentOS 7.2 and want to deactivate IPC object removal by creating the `gpadmin` user as a system account, provide both the `-r` option (create the user as a system account) and the `-m` option (create a home directory) to the `useradd` command. This example creates the `gpadmin` group, creates the `gpadmin` user as a system account with a home directory and as a member of the `gpadmin` group, and creates a password for the user. diff --git a/docs/whpg/6x/install_guide/install_whpg.md b/docs/whpg/6x/install_guide/install_whpg.md index ecf96e0..b3a12d9 100644 --- a/docs/whpg/6x/install_guide/install_whpg.md +++ b/docs/whpg/6x/install_guide/install_whpg.md @@ -45,9 +45,9 @@ See [Example Ansible Playbook](ansible-example.md) for an example script that sh Follow these instructions to install WarehousePG from a pre-built binary. -> **Important** You require sudo or root user access to install from a pre-built RPM or DEB file. +> **Important** You require sudo or root user access to install from a pre-built RPM file. -1. Download and copy the WarehousePG package to the `gpadmin` user's home directory on the coordinator, standby coordinator, and every segment host machine. The distribution file name has the format `greenplum-db--.rpm` for RHEL, CentOS, and Oracle Linux systems, or `greenplum-db--.deb` for Ubuntu systems, where `` is similar to `rhel7-x86_64` (Red Hat 7 64-bit). +1. Download and copy the WarehousePG package to the `gpadmin` user's home directory on the coordinator, standby coordinator, and every segment host machine. The distribution file name has the format `greenplum-db--.rpm` for RHEL, CentOS, and Oracle Linux systems, where `` is similar to `rhel7-x86_64` (Red Hat 7 64-bit). > **Note** For Oracle Linux installations, download and install the `rhel7-x86_64`distribution files. @@ -58,13 +58,8 @@ Follow these instructions to install WarehousePG from a pre-built binary. ``` $ sudo yum install ./greenplum-db--.rpm ``` - - For Ubuntu systems, run the `apt` command: - - ``` - $ sudo apt install ./greenplum-db--.deb - ``` - The `yum` or `apt` command automatically installs software dependencies, copies the WarehousePG software files into a version-specific directory under `/usr/local`, `/usr/local/greenplum-db-`, and creates the symbolic link `/usr/local/greenplum-db` to the installation directory. + The `yum` command automatically installs software dependencies, copies the WarehousePG software files into a version-specific directory under `/usr/local`, `/usr/local/greenplum-db-`, and creates the symbolic link `/usr/local/greenplum-db` to the installation directory. 3. Change the owner and group of the installed files to `gpadmin`: @@ -83,7 +78,7 @@ Follow these instructions to install WarehousePG to a specific directory. > **Important** You require sudo or root user access to install from a pre-built RPM file. -1. Download and copy the WarehousePG package to the `gpadmin` user's home directory on the coordinator, standby coordinator, and every segment host machine. The distribution file name has the format `greenplum-db--.rpm` for RHEL and CentOS systems, or `greenplum-db--.deb` for Ubuntu systems, where `` is similar to `rhel7-x86_64` (Red Hat 7 64-bit). +1. Download and copy the WarehousePG package to the `gpadmin` user's home directory on the coordinator, standby coordinator, and every segment host machine. The distribution file name has the format `greenplum-db--.rpm` for RHEL and CentOS systems, where `` is similar to `rhel7-x86_64` (Red Hat 7 64-bit). 2. Manually install the WarehousePG dependencies to each host system: diff --git a/docs/whpg/6x/install_guide/migrate-linux.md b/docs/whpg/6x/install_guide/migrate-linux.md index 8265fd5..befc958 100644 --- a/docs/whpg/6x/install_guide/migrate-linux.md +++ b/docs/whpg/6x/install_guide/migrate-linux.md @@ -375,7 +375,7 @@ When you prepare your operating system environment for WarehousePG software inst ### XFS Mount Options -XFS is the preferred data storage file system on Linux platforms. Use the mount command with the following recommended XFS mount options. The `nobarrier` option is not supported on EL 8/9 or Ubuntu systems. Use only the options `rw,nodev,noatime,inode64`. +XFS is the preferred data storage file system on Linux platforms. Use the mount command with the following recommended XFS mount options. The `nobarrier` option is not supported on EL 8/9 systems. Use only the options `rw,nodev,noatime,inode64`. diff --git a/docs/whpg/6x/install_guide/platform-requirements.md b/docs/whpg/6x/install_guide/platform-requirements.md index 6927b7b..9390e6f 100644 --- a/docs/whpg/6x/install_guide/platform-requirements.md +++ b/docs/whpg/6x/install_guide/platform-requirements.md @@ -19,7 +19,6 @@ WarehousePG 6 runs on the following operating system platforms: - Rocky Linux 8.7 or later - CentOS 64-bit 7.x - CentOS 64-bit 6.x -- Ubuntu 18.04 LTS - Oracle Linux 64-bit 7, using the Red Hat Compatible Kernel (RHCK) @@ -37,7 +36,7 @@ RHEL 7.3 and CentOS 7.3 resolves the issue. > **Caution** A kernel issue in Red Hat Enterprise Linux 8.5 and 8.6 can cause I/O freezes and synchronization problems with XFS filesystems. This issue is fixed in RHEL 8.7. See [RHEL8: xfs_buf deadlock between inode deletion and block allocation](https://access.redhat.com/solutions/6984334). -WarehousePG server supports TLS version 1.2 on RHEL/CentOS systems, and TLS version 1.3 on Ubuntu systems. +WarehousePG server supports TLS version 1.2 and TLS version 1.3 on RHEL/CentOS systems. @@ -91,36 +90,6 @@ WarehousePG 6 client software requires these operating system packages: - openssh - zlib -On Ubuntu systems, WarehousePG 6 requires the following software packages, which are installed automatically as dependencies when you install WarehousePG with the Debian package installer: - -- bash -- bzip2 -- iproute2 -- iputils-ping -- krb5-multidev -- libapr1 -- libaprutil1 -- libcurl3-gnutls -- libcurl4 -- libevent-2.1-6 -- libldap-2.4-2 -- libreadline7 or libreadline8 -- libuuid1 -- libxml2 -- libyaml-0-2 -- less -- locales -- net-tools -- openssh-client -- openssh-server -- openssl -- perl -- rsync -- sed -- tar -- zip -- zlib1g - WarehousePG 6 uses Python 2.7.18, which is included with the product installation (and not installed as a package dependency). > **Important** SSL is supported only on the WarehousePG coordinator host system. It cannot be used on the segment host systems. @@ -162,8 +131,7 @@ This table lists the versions of the WarehousePG Extensions that are compatible PL/R 3.0.3 -(CentOS) R 3.3.3

(Ubuntu) You install R 3.5.1+.

- +R 3.3.3 MADlib Machine Learning @@ -272,7 +240,7 @@ The disk settings for cloud deployments are the same as on-premise with a few mo ``` rw,noatime,nobarrier,nodev,inode64 ``` - > **Note** The `nobarrier` option is not supported on RHEL 8 or Ubuntu nodes. + > **Note** The `nobarrier` option is not supported on RHEL 8 nodes. - Use mq-deadline instead of the deadline scheduler for the R5 series instance type in AWS - Use a swap disk per VM (32GB size works well) diff --git a/docs/whpg/6x/install_guide/upgrading.md b/docs/whpg/6x/install_guide/upgrading.md index 2b45fe2..fa95773 100644 --- a/docs/whpg/6x/install_guide/upgrading.md +++ b/docs/whpg/6x/install_guide/upgrading.md @@ -51,7 +51,7 @@ Starting from WarehousePG 6.27.4, the default installation directory is `/usr/ed 3. Copy the new WarehousePG software installation package to the `gpadmin` user's home directory on each coordinator, standby, and segment host. -4. *If you used `yum` or `apt` to install WarehousePG to the default location*, run these commands on each host to upgrade to the new software release. +4. *If you used `yum` to install WarehousePG to the default location*, run this command on each host to upgrade to the new software release. For RHEL/CentOS systems: @@ -59,13 +59,7 @@ Starting from WarehousePG 6.27.4, the default installation directory is `/usr/ed $ sudo yum upgrade ./greenplum-db--.rpm ``` - For Ubuntu systems: - - ``` - # apt install ./greenplum-db--.deb - ``` - - The `yum` or `apt` command installs the new WarehousePG software files into a version-specific directory under `/usr/edb/whpg6` and updates the symbolic link `/usr/local/greenplum-db` to point to the new installation directory. + The `yum` command installs the new WarehousePG software files into a version-specific directory under `/usr/edb/whpg6` and updates the symbolic link `/usr/local/greenplum-db` to point to the new installation directory. 5. *If you used `rpm` to install WarehousePG to a non-default location on RHEL/CentOS systems*, run `rpm` on each host to upgrade to the new software release and specify the same custom installation directory with the `--prefix` option. For example: diff --git a/docs/whpg/7x/admin_guide/analytics/procedural_languages/pl_r.md b/docs/whpg/7x/admin_guide/analytics/procedural_languages/pl_r.md index 8303b72..50ef75c 100644 --- a/docs/whpg/7x/admin_guide/analytics/procedural_languages/pl_r.md +++ b/docs/whpg/7x/admin_guide/analytics/procedural_languages/pl_r.md @@ -103,7 +103,6 @@ PL/R is registered as an untrusted language. ### Uninstalling PL/R - [Remove PL/R Support for a Database](#topic7) -- [Uninstall R (Ubuntu)](#topic_ifv_tsf_w3b) When you remove PL/R language support from a database, the PL/R routines that you created in the database will no longer work. @@ -119,19 +118,6 @@ $ psql -d testdb -c 'DROP EXTENSION plr;' The default command fails if any existing objects (such as functions) depend on the language. Specify the `CASCADE` option to also drop all dependent objects, including functions that you created with PL/R. - - -#### Uninstall R (Ubuntu) - -For Ubuntu systems, remove R from all WarehousePG host systems. These commands remove R from an Ubuntu system. - -``` -$ sudo apt remove r-base -$ sudo apt remove r-base-core -``` - -Removing `r-base` does not uninstall the R executable. Removing `r-base-core` uninstalls the R executable. - ### Examples diff --git a/docs/whpg/7x/admin_guide/manage_access/client_auth/index.md b/docs/whpg/7x/admin_guide/manage_access/client_auth/index.md index 389139b..b8a4768 100644 --- a/docs/whpg/7x/admin_guide/manage_access/client_auth/index.md +++ b/docs/whpg/7x/admin_guide/manage_access/client_auth/index.md @@ -207,6 +207,26 @@ gpconfig -c ssl -m on -v off Setting the parameter requires a server restart. This command restarts the system: `gpstop -ra`. + + +### Requiring a Minimum TLS Version + +WarehousePG negotiates the highest TLS protocol version that both the client and the coordinator support. When both endpoints run OpenSSL 1.1.1 or later, connections use TLS 1.3 automatically, with no additional configuration required. + +To require a minimum TLS protocol version instead of relying on automatic negotiation, set the server configuration parameter `ssl_min_protocol_version` on the coordinator and standby coordinator hosts. For example, this `gpconfig` command requires TLS 1.3 for all connections: + +``` +gpconfig -c ssl_min_protocol_version -v 'TLSv1.3' +``` + +Setting the parameter requires a server restart. Run `gpstop -ra` to restart the system. + +Valid values for `ssl_min_protocol_version` are `TLSv1`, `TLSv1.1`, `TLSv1.2`, and `TLSv1.3`. A related parameter, `ssl_max_protocol_version`, sets the maximum protocol version and accepts the same values, plus an empty string to allow the latest version that both endpoints support with no upper bound. For more information about both parameters, see [ssl_min_protocol_version](../../../ref_guide/config_params/guc-list.md#ssl_min_protocol_version) and [ssl_max_protocol_version](../../../ref_guide/config_params/guc-list.md#ssl_max_protocol_version) in the *WarehousePG Reference Guide*. + +::: info Note +The `ssl_min_protocol_version` and `ssl_max_protocol_version` parameters and the `pg_stat_ssl` system view are not available in WarehousePG 6. +::: + ### Creating a Self-signed Certificate without a Passphrase for Testing Only @@ -214,7 +234,7 @@ Setting the parameter requires a server restart. This command restarts the syste To create a quick self-signed certificate for the server for testing, use the following OpenSSL command: ``` -# openssl req -new -text -out server.req +openssl req -new -text -out server.req ``` @@ -225,8 +245,8 @@ The program will generate a key that is passphrase protected, and does not accep To use this certificate with WarehousePG, remove the passphrase with the following commands: ``` -# openssl rsa -in privkey.pem -out server.key -# rm privkey.pem +openssl rsa -in privkey.pem -out server.key +rm privkey.pem ``` Enter the old passphrase when prompted to unlock the existing key. @@ -234,13 +254,13 @@ Enter the old passphrase when prompted to unlock the existing key. Then, enter the following command to turn the certificate into a self-signed certificate and to copy the key and certificate to a location where the server will look for them. ``` -# openssl req -x509 -in server.req -text -key server.key -out server.crt +openssl req -x509 -in server.req -text -key server.key -out server.crt ``` Finally, change the permissions on the key with the following command. The server will reject the file if the permissions are less restrictive than these. ``` -# chmod og-rwx server.key +chmod og-rwx server.key ``` For more details on how to create your server private key and certificate, refer to the [OpenSSL documentation](https://www.openssl.org/docs/). diff --git a/docs/whpg/7x/admin_guide/performance/wlmgmt/workload_mgmt_resgroups.md b/docs/whpg/7x/admin_guide/performance/wlmgmt/workload_mgmt_resgroups.md index 0a7829c..bb926de 100644 --- a/docs/whpg/7x/admin_guide/performance/wlmgmt/workload_mgmt_resgroups.md +++ b/docs/whpg/7x/admin_guide/performance/wlmgmt/workload_mgmt_resgroups.md @@ -216,12 +216,6 @@ You do not need to change your version of cgroup, you can simply skip to [Config ``` grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="systemd.unified_cgroup_hierarchy=1" ``` -- Ubuntu systems: - ``` - vim /etc/default/grub - # add or modify: GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1" - update-grub - ``` If you want to switch from cgroup v2 to v1, run the following commands as root: @@ -229,12 +223,6 @@ If you want to switch from cgroup v2 to v1, run the following commands as root: ``` grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="systemd.unified_cgroup_hierarchy=0 systemd.legacy_systemd_cgroup_controller" ``` -- Ubuntu systems: - ``` - vim /etc/default/grub - # add or modify: GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=0" - update-grub - ``` After that, reboot your host in order for the changes to take effect. diff --git a/docs/whpg/7x/install_guide/config_os.md b/docs/whpg/7x/install_guide/config_os.md index 4fc25e2..f3516fd 100644 --- a/docs/whpg/7x/install_guide/config_os.md +++ b/docs/whpg/7x/install_guide/config_os.md @@ -386,11 +386,11 @@ The XFS options can also be set in the `/etc/fstab` file. This example entry fro | Storage Device Type | OS | Recommended Scheduler Policy | | :--------------------------------- | :----------------------------------------- | :--------------------------- | - | Non-Volatile Memory Express (NVMe) | RHEL 7
RHEL 8
RHEL 9
Ubuntu | `none` | - | Solid-State Drives (SSD) | RHEL 7 | `noop` | - | Solid-State Drives (SSD) | RHEL 8
RHEL 9
Ubuntu | `none` | - | Other | RHEL 7 | `deadline` | - | Other | RHEL 8
RHEL 9
Ubuntu | `mq-deadline` | + | Non-Volatile Memory Express (NVMe) | RHEL 7
RHEL 8
RHEL 9 | `none` | + | Solid-State Drives (SSD) | RHEL 7 | `noop` | + | Solid-State Drives (SSD) | RHEL 8
RHEL 9 | `none` | + | Other | RHEL 7 | `deadline` | + | Other | RHEL 8
RHEL 9 | `mq-deadline` | To specify a scheduler until the next system reboot, run the following: @@ -461,12 +461,6 @@ On systems that use `grub2`, use the system utility `grubby`. This command adds After adding the parameter, reboot the system. -For Ubuntu systems, install the `hugepages` package and run this command as root: - -``` -# hugeadm --thp-never -``` - This cat command checks the state of THP. The output indicates that THP is deactivated. ``` @@ -646,7 +640,7 @@ The following steps show how to set up the `gpadmin` user on a host, set a passw 1. Create the `gpadmin` group and user. - > **Note** If you are installing WarehousePG on RHEL 7.2 or CentOS 7.2 and want to deactivate IPC object removal by creating the `gpadmin` user as a system account, provide both the `-r` option (create the user as a system account) and the `-m` option (create a home directory) to the `useradd` command. On Ubuntu systems, you must use the `-m` option with the `useradd` command to create a home directory for a user. + > **Note** If you are installing WarehousePG on RHEL 7.2 or CentOS 7.2 and want to deactivate IPC object removal by creating the `gpadmin` user as a system account, provide both the `-r` option (create the user as a system account) and the `-m` option (create a home directory) to the `useradd` command. This example creates the `gpadmin` group, creates the `gpadmin` user as a system account with a home directory and as a member of the `gpadmin` group, and creates a password for the user. diff --git a/docs/whpg/7x/install_guide/install_whpg.md b/docs/whpg/7x/install_guide/install_whpg.md index 07c5cb0..14de8b7 100644 --- a/docs/whpg/7x/install_guide/install_whpg.md +++ b/docs/whpg/7x/install_guide/install_whpg.md @@ -45,7 +45,7 @@ Before you begin installing WarehousePG, be sure you have completed the steps in Follow these instructions to install WarehousePG from a pre-built binary. -> **Important** You require sudo or root user access to install from a pre-built RPM or DEB file. +> **Important** You require sudo or root user access to install from a pre-built RPM file. 1. Download and copy the WarehousePG package to the `gpadmin` user's home directory on the coordinator, standby coordinator, and every segment host machine. The distribution file name has the format `greenplum-db--.rpm` for RHEL, Oracle Linux, or Rocky Linux systems. diff --git a/docs/whpg/7x/install_guide/platform-requirements.md b/docs/whpg/7x/install_guide/platform-requirements.md index a89e521..c271c06 100644 --- a/docs/whpg/7x/install_guide/platform-requirements.md +++ b/docs/whpg/7x/install_guide/platform-requirements.md @@ -19,7 +19,7 @@ WarehousePG 7 runs on the following operating system platforms: > **Caution** A kernel issue in Red Hat Enterprise Linux 8.5 and 8.6 can cause I/O freezes and synchronization problems with XFS filesystems. This issue is fixed in RHEL 8.7. See [RHEL8: xfs_buf deadlock between inode deletion and block allocation](https://access.redhat.com/solutions/6984334). -WarehousePG server supports TLS version 1.2 on RHEL/CentOS systems, and TLS version 1.3 on Ubuntu systems. +WarehousePG server supports TLS version 1.2 and TLS version 1.3 on RHEL/CentOS systems. @@ -133,7 +133,7 @@ This table lists the versions of the WarehousePG Extensions that are compatible | Component | Package Version | Additional Information | |-----------|----------------|----------------------| | [PL/Java](../admin_guide/analytics/procedural_languages/pl_java.md) | 2.0.7 | Supports Java 8 and 11. | -| [PL/R](../admin_guide/analytics/procedural_languages/pl_r.md) | 3.1.1 | (CentOS) R 3.3.3
(Ubuntu) You install R 3.5.1+. | +| [PL/R](../admin_guide/analytics/procedural_languages/pl_r.md) | 3.1.1 | R 3.3.3 | | PL/Container Image for R | 2.1.2 | R 3.6.3 | | PL/Container Images for Python | 2.1.2 | Python 2.7.12
Python 3.7 | | [MADlib Machine Learning](../admin_guide/analytics/madlib.md) | 2.1.0 | Support matrix at [MADlib FAQ](https://cwiki.apache.org/confluence/display/MADLIB/FAQ#FAQ-Q1-2WhatdatabaseplatformsdoesMADlibsupportandwhatistheupgradematrix?). | @@ -224,7 +224,7 @@ The disk settings for cloud deployments are the same as on-premise with a few mo ``` rw,noatime,nobarrier,nodev,inode64 ``` - > **Note** The `nobarrier` option is not supported on RHEL 8 or Ubuntu nodes. + > **Note** The `nobarrier` option is not supported on RHEL 8 nodes. - Use mq-deadline instead of the deadline scheduler for the R5 series instance type in AWS - Use a swap disk per VM (32GB size works well) diff --git a/docs/whpg/7x/ref_guide/config_params/guc-list.md b/docs/whpg/7x/ref_guide/config_params/guc-list.md index 7ed9a97..24d51a7 100644 --- a/docs/whpg/7x/ref_guide/config_params/guc-list.md +++ b/docs/whpg/7x/ref_guide/config_params/guc-list.md @@ -3810,6 +3810,30 @@ See the openssl manual page for a list of supported ciphers. | ----------- | --------------------------------- | ---------------------------- | | string | ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH | coordinator, system, restart | + + +## ssl_max_protocol_version + +Sets the maximum TLS protocol version that WarehousePG accepts for secure connections. An empty string, the default, allows any protocol version up to the most recent version supported by the OpenSSL library used to build WarehousePG. + +| Value Range | Default | Set Classifications | +| --------------------------------------------------- | ------- | ----------------------------- | +| TLSv1, TLSv1.1, TLSv1.2, TLSv1.3, or an empty string | | coordinator, system, restart | + + + +## ssl_min_protocol_version + +Sets the minimum TLS protocol version that WarehousePG accepts for secure connections. WarehousePG rejects connections that negotiate an earlier protocol version. See [Requiring a Minimum TLS Version](../../admin_guide/manage_access/client_auth/index.md#topic_ssl_min_version) in the *WarehousePG Administrator Guide* for an example that requires TLS 1.3. + +::: info Note +This parameter is not available in WarehousePG 6. +::: + +| Value Range | Default | Set Classifications | +| ------------------------------------- | ------- | ----------------------------- | +| TLSv1, TLSv1.1, TLSv1.2, or TLSv1.3 | TLSv1.2 | coordinator, system, restart | + ## standard_conforming_strings