Installing the eperi sEcure Platform database

To operate eperi sEcure Platform, it is necessary to set up a database in which eperi sEcure Platform stores configuration data and token values.

About this task

eperi sEcure Platform supports the use of different database management systems (DBMS). Depending on the selected DBMS, certain requirements must be met:

Table 1. DBMS requirements
DBMS	Versions supported by eperi sEcure Platform	Requirements
Oracle	11, 12 or 18c	Dedicated database user for the eperi sEcure Platform (user default schema will be used) The user also requires the following privileges: CREATE TABLE CREATE SEQUENCE CREATE TRIGGER CREATE SESSION A UTF-8 compatible encoding is assumed, i.e., the setting NLS_CHARACTERSET must be set to `AL32UTF8` for example. TCP-based communication with the eperi sEcure Platform server (configurable, e.g., port 1521)
MariaDB	10.2 or higher	Grant all privileges on the eperi sEcure Platform database to the database user Collation of the database: utf8_bin TCP-based communication with the eperi sEcure Platform server (configurable, e.g., port 3306) Set the default time zone in the configuration file /etc/my.cnf to UTC: `[mysqld] default-time-zone='+00:00'` Note: Support for MySQL has been deprecated.
Microsoft SQL Server	2016 or higher	Grant the role db_owner or the roles db_ddladmin, db_datawriter and db_datareader on the eperi sEcure Platform database to the database user The default schema of the database user has to be used and configured as schema name in the eperi sEcure Platform database configuration. If several eperi sEcure Platform instances are using the same SQL Server database but use different database users, all configured database users must have the same default schema. TCP-based communication with the eperi sEcure Platform server (configurable, e.g., port 1433) Collation of the database: SQL_Latin1_General_CP1_CS_AS
Azure SQL	12.0 or higher	Grant the role db_owner or the roles db_ddladmin, db_datawriter and db_datareader on the eperi sEcure Platform database to the database user If several eperi sEcure Platform instances are using the same SQL Server database but use different database users, all configured database users must have the same default schema. TCP-based communication with the eperi sEcure Platform server (configurable, e.g., port 1433) Collation of the database: SQL_Latin1_General_CP1_CS_AS
Requirements that apply to all of the above DBMS:		Quota for tablespace: At least 50 MB. The quota actually required depends on the number and size of the tokenized values. Approximately 300 MB are required per one million tokens. Allow at least 30 parallel database connections per eperi sEcure Platform and database user.

Note: As an example, the installation of MariaDB on Ubuntu or CentOS is described below.

Important: Please make sure to install MariaDB version 10.2 or higher! Older versions are not supported by the eperi sEcure Platform!

Procedure

For an installation of MariaDB on Ubuntu 16.04 LTS or 18.04 LTS, proceed as follows:
1. Go to the MariaDB Repositories setup page.
2. Choose your Distro, Release, Database version (10.2 or higher) and Mirror.
3. Run the commands as displayed on the website.
If you are using Ubuntu 20.04 LTS you can install MariaDB 10.3 with the following command:
```
sudo apt install mariadb-server
```
For an installation of MariaDB on CentOS 8, proceed as follows:
1. In the directory /etc/yum.repos.d/ create a new file named mariadb.repo.
2. Paste the following code into the mariadb.repo file:
```
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.4/centos8-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1
```
3. Change the baseurl according to the operating system version and architecture used.
  
  Tip: Let the Repository Configuration Tool generate the proper MariaDB YUM repository entry for your operating system.
4. Install MariaDB with:
```
sudo dnf install boost-program-options
sudo dnf install MariaDB-server MariaDB-client --disablerepo=AppStream 
```
5. Enable MariaDB to start on boot and start the service:
```
sudo systemctl enable mariadb
sudo systemctl start mariadb
```
Secure the MariaDB installation by running the mysql_secure_installation script:
```
sudo mysql_secure_installation
```
Note: According to the MariaDB documentation, this script is not 100% safe for use with Galera Cluster as it directly manipulates the mysql.user table which is not transported by Galera to the other nodes. The script should be run on the first node in the cluster before adding more nodes.
Log in with the root user:
```
sudo mysql -u root -p
```
Important: In case of a cluster setup, perform this and all subsequent steps only on one of your MariaDB Galera cluster nodes, since the eperi sEcure Platform database will automatically be replicated to the other cluster nodes.
Create a token database with a name that fits your organizational naming convention:
```
CREATE DATABASE eperi;
```

Change the collation to utf8_bin:

ALTER DATABASE eperi COLLATE = 'utf8_bin';

Create a special database user for connecting the eperi sEcure Platform to the MariaDB DMBS:
```
CREATE USER 'eperi_dbuser'@'%' IDENTIFIED BY 'YET_ANOTHER_SECRET_PASSWORD';
```
Grant all privileges for the eperi database to the eperi_dbuser:
```
GRANT ALL PRIVILEGES ON eperi.* TO 'eperi_dbuser'@'%' WITH GRANT OPTION;
```
```
FLUSH PRIVILEGES;
```
Important: If you want to secure the database connection with TLS, it is necessary to create a user with TLS-related restrictions. Furthermore it is required to configure MariaDB to use TLS v1.2. For details please refer to the MariaDB documentation.
Log out with:
```
quit;
```

Results

You have successfully installed and configured the database for eperi sEcure Platform. In case of a cluster setup, the database will automatically be replicated to the other nodes of the MariaDB Galera cluster.

What to do next

Continue with Getting the software.