TLS security for Sybase ASE
SAP offers a method to configure Sybase ASE instances utilizing TLS, enhancing security for connections to the Sybase ASE database.
Starting with release 23.0.0.0, Delphix Continuous Data Engine has introduced support for Sybase ASE instances configured with TLS. JDBC connections established by Delphix Continuous Data Engine to Sybase ASE instances can now be TLS enabled.
Implementing TLS support in the Delphix Continuous Data Engine
This feature enables the TLS support that provides the encrypted JDBC connections between Delphix Continuous Data Engine and Sybase hosts.
Delphix Continuous Data Engine requires the following steps to be taken to support TLS for Sybase ASE instances:
Disable all Sybase ASE dSources and VDBs running on the ASE instance to prevent connection failures during TLS setup.
Configure the Sybase ASE instance with TLS, ensuring the use of TLSv1.2.
If utilizing a self-signed certificate or a private PKI, you must include the signing certificate into the Delphix trust store. This can be accomplished by logging into Delphix Continuous Data Engine using the "sysadmin" user and adding the ASE instance's certificate in the setup application as instructed in the "Adding a certificate" section of the TrustStore settings page.
Restart the Delphix Continuous Data Engine by selecting the Restart button available under the three dots (...) menu at the top of the page where the certificate was added.
Access the CLI using the "admin" user and enable TLS support by setting the parameter
enableTls
totrue
for existing environments configured to use TLS following the above steps.CODEip-10-110-225-100> environment ip-10-110-225-100 environment> select Src ip-10-110-225-100 environment 'Src'> update ip-10-110-225-100 environment 'Src' update *> edit aseHostEnvironmentParameters ip-10-110-225-100 environment 'Src' update aseHostEnvironmentParameters *> ls Properties type: ASEHostEnvironmentParameters credentials: type: PasswordCredential password: ******** dbUser: sa enableTls: false skipServerCertificateValidation: false ip-10-110-225-100 environment 'Src' update aseHostEnvironmentParameters *> set enableTls=true ip-10-110-225-100 environment 'Src' update aseHostEnvironmentParameters *> commit Dispatched job JOB-39 ENVIRONMENT_UPDATE job started for "Src". ENVIRONMENT_UPDATE job for "Src" completed successfully.
Next, log in to the Delphix Continuous Data Engine UI using the "admin" user and initiate a refresh of the environment for which TLS support has been enabled. Upon successful completion of the environment refresh, navigate to the database tab on the environment page to locate the TLS port. If Delphix Continuous Data Engine encounters any issues discovering ASE instances (whether auto-discovered or manually added) running on the TLS port during the environment refresh operation, it will display an error or fallback to the TCP port if available, raising a corresponding fault.
Re-enable the dSources and VDBs that were disabled in the initial step.
If you want to create a new environment with TLS encryption enabled, you can do so by setting the parameter
enableTls
totrue
inASEHostEnvironmentParameters
.CODEip-10-110-225-100 environment create *> ls Properties type: HostEnvironmentCreateParameters hostEnvironment: type: UnixHostEnvironment name: Src (*) aseHostEnvironmentParameters: type: ASEHostEnvironmentParameters (*) credentials: type: PasswordCredential (*) password: ******** (*) dbUser: sa (*) enableTls: true (*) skipServerCertificateValidation: (unset) description: (unset) logCollectionEnabled: false hostParameters: type: UnixHostCreateParameters host: type: UnixHost address: kanojis-centos-79-sybase-160-src.dlpxdc.co (*) dspKeystoreAlias: (unset) dspKeystorePassword: (unset) dspKeystorePath: (unset) dspTruststorePassword: (unset) dspTruststorePath: (unset) javaHome: (unset) nfsAddressList: (unset) oracleHostParameters: (unset) privilegeElevationProfile: (unset) sshPort: 22 sshVerificationStrategy: (unset) toolkitPath: /work (*) logCollectionEnabled: false primaryUser: type: EnvironmentUser name: sybase (*) credential: type: PasswordCredential password: ******** (*) environment: (unset) groupId: (unset) userId: (unset) ip-10-110-225-100 environment create *> commit `UNIX_HOST_ENVIRONMENT-15 Dispatched job JOB-159 ENVIRONMENT_CREATE_AND_DISCOVER job started for "Src". ENVIRONMENT_CREATE_AND_DISCOVER job for "Src" completed successfully.
Do not set the parameter “skipServerCertificateValidation” to “true” until or unless you don’t want to add the certificate to Delphix Continuous Data Engine. Setting it to “true” will skip the Sybase ASE server certificate validation during the TLS handshake. Delphix strongly advises against this setting, as it will compromise the integrity and security of encrypted communication by exposing it to the risk of interception and impersonation. If you still choose to compromise TLS security by not adding the certificate into Delphix Continuous Data Engine and setting the parameter
skipServerCertificateValidation
totrue
, then you can skip adding the certificate & restart the Delphix Continuous Data Engine as outlined above.