How to set secured connections to Database on Netezza host outside the firewall?

Answer

The Netezza system provides a flexible way to configure access security and encryption for your client users.

We can create connection records using "SET CONNECTION" command. This creates a connection record for client users.

Example:

SET CONNECTION HOSTSSL DATABASE 'ALL' IPADDR '1.2.3.4' IPMASK '255.255.255.255' -AUTH SHA256;

This allow user to connect to Netezza host outside the network firewall from IP address 1.2.3.4.

DATABASE 'ALL' : Allow connections to any database on the Netezza system. If you want to restrict connection's to specific database, instead of 'ALL' specify Database name.

IPMASK '255.255.255.255' allows only the connection from the specific IP address (1.2.3.4).
If we use IPMASK 255.255.255.0, it indicates that the record defines connection attempts for any client that has an IP address in the range of 1.2.3.1–255.

You can find more field descriptions in following IBM Knowledge Centre link:

https://www.ibm.com/support/knowledgecenter/SSULQD_7.2.1/com.ibm.nz.adm.doc/c_sysadm_config_host_auth_for_clients.html?lang=en

Once the connection record is created you can see the details using "SHOW CONNECTION" command.

Example:

SYSTEM.ADMIN(ADMIN)=> SHOW CONNECTION;

CONNID | CONNTYPE | CONNDB | CONNIPADDR | CONNIPMASK | CONNAUTH
--------+-----------+--------+-------------+-----------------+--------
1 | local | all | | | trust
2 | host | all | 127.0.0.1 | 255.255.255.255 | md5
3 | hostssl | all | 1.2.3.4 | 255.255.255.255 | SHA256