cossacklabs/acra

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

Database protection suite with field level encryption and intrusion detection.

---

Acra Engineering Examples	Documentation and tutorials	Installation	Acra feedback

What is Acra

Acra — database security suite for sensitive and personal data protection.

Acra provides application-level encryption for data fields, multi-layered access control, database leakage prevention, and intrusion detection capabilities in one suite. Acra was specifically designed for distributed apps (web, server-side and mobile) that store data in one or many databases / datastores.

Perfect Acra-compatible applications	Typical industries
Web and mobile apps that store data in a centralised database or object storage	Healthcare, patient apps Finance, fintech, neobanking SaaS Critical infrastructures Apps with > 1000 users
IoT apps that collect telemetry and process data in the cloud
High-load data processing apps

Acra gives you tools for encrypting each sensitive data record (data field, database cell, json) before storing them in the database / file storage. And then decrypting them in a secure compartmented area (on Acra side). Acra allows to encrypt data as early as possible and operate on encrypted data.

Acra's cryptographic design ensures that no secret (password, key, etc.) leaked from the application or database will be sufficient for decryption of the protected data. Acra minimises the leakage scope, detects unauthorised behavior, and prevents the leakage, informing operators of the incident underway.

This is Acra Community Edition, it's free for commercial and non-commercial use, forever.

Major security features

Application-level encryption	encryption on client-side and/or Acra-side – each data field is encrypted using unique encryption keys.
Selective encryption	you select which columns to encrypt to balance good security and performance.
Fast and reliable crypto	two crypto-envelopes: AcraBlocks and AcraStructs. AcraBlocks are fast symmetric containers, use them by default. AcraStructs are asymmetric containers, use them for client-side encryption.
Searchable encryption	search through encrypted data without decryption. Designed for exact queries, based on AES-GCM and blind index.
Masking / anonymization	use full or partial masking to remove or mask sensitive data.
Tokenization	substitute sensitive data with a token and match it to original only when needed.
Basic key management tools	built-in tools for key generation, export, backup, rotation, etc.
Blocking suspicious SQL queries	through a built-in SQL firewall.
Intrusion detection	using poison records (honey tokens) to warn about suspicious behaviour.
Key rotation without data re-encryption ᵉ	available for Acra Enterprise users.
KMS support ᵉ
Cryptographically protected audit log ᵉ

Acra delivers different layers of defense for different parts and stages of the data lifecycle. This is what defence in depth is – an independent set of security controls aimed at mitigating multiple risks in case of an attacker crossing the outer perimeter.

Multiple ways to integrate

AcraServer: transparent SQL proxy	all Acra features packed into a database proxy that parses traffic between an app and a database and applies security functions where appropriate.
AcraTranslator: encryption-as-a-service API	API server, that exposes most of Acra’s features as HTTP / gRPC API with traffic protection.
AcraConnector: transport authentication and encryption	optional client-side service for authentication and transport encryption.
AnyProxy: use Acra with any database / datastore via SDK ᵉ	available for Acra Enterprise users.
AcraWriter: SDK for client-side encryption ᵉ
AcraReader: SDK for client-side decryption ᵉ
SDK for AcraTranslator: client-side SDK that encapsulates AcraTranslator's API ᵉ
Bulk API for AcraTranslator ᵉ

Developer and DevOps friendly

Secure default settings	your infrastructure is secure from the start without additional configuring.
Cryptography is hidden under the hood	no risk of selecting the wrong key length or algorithm padding.
Automation-friendly	easy to configure and automate.
Quick infrastructure integration	via binary packages or Docker images.
Easy client-side integration	requires minimal changes in the application code.
Logging, metrics, tracing	throughout all Acra components; compatible with ELK stack, Datadog, Graylog, Prometheus, Grafana, Jaeger.
No vendor lock	rollback utilities to decrypt database into plaintext.
Demos and examples	numerous web-based and Docker-based example projects available.
DigitalOcean Acra 1-Click App	run AcraServer in your DigitalOcean cloud.
Managed solution available	we can setup and manage Acra for you.

Cryptography

Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best available open-source implementations of the most reliable ciphers. Acra strictly doesn't contain self-made cryptographic primitives or obscure ciphers.

To deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme. See Cryptography and key management.

Default crypto-primitive source	OpenSSL
Supported crypto-primitive sources ᵉ	BoringSSL, LibreSSL, FIPS-compliant, GOST-compliant, HSM
Storage encryption (AcraBlocks)	AES-256-GCM + AES-256-GCM
Storage encryption (AcraStructs)	AES-256-GCM + ECDH
Transport encryption	TLS v1.2+ or Themis Secure Session
KMS integration ᵉ	Amazon KMS, Google Cloud Platform KMS, HashiCorp Vault, Keywhiz, etc

ᵉ — available in the Enterprise version of Acra only. Drop us an email to get a full list of features and a quote.

How does Acra work?

Acra consists of several services and utilities. Acra services allow you to construct infinitely sophisticated data flows that are perfectly suited to your exact infrastructure. Depending on your architecture and use case, you might need to deploy only basic services or all of them.

• Security enforcement components: services where "encryption happens". One of them is required: AcraServer, AcraTranslator, AnyProxy, or client-side SDKs.
• Key storage: datastores where Acra keeps encrypted keys: Redis, table in your database, any KV store. One of them is required.
• Master key storage: KMS, Vault. One of them is strongly recommended.
• Additional services and utils: key management utils, data migration scripts, transport security service, policy management tools. Any of them are optional.

Refer to Acra-in-depth / Architecture to learn more about Acra components. Refer to Acra-in-depth / Data flow to see more typical Acra-based dataflows and deployments.

Protecting data in SQL databases using AcraServer

Let's see the simplest dataflow with AcraServer.

AcraServer works as transparent encryption/decryption proxy with SQL databases. The application doesn't know that the data is encrypted before it gets to the database, the database also doesn't know that someone has encrypted the data. That's why we often call this mode a "transparent encryption".

You have a client-side application that talks to the SQL database. You add AcraServer in the middle, working as SQL proxy, and point application to it.

This is what the process of writing and reading the data to/from a database looks like:

1. You deploy AcraServer and configure it: connection to the database, TLS certificates, select which fields to encrypt, mask or tokenise, enable SQL request firewall, etc.
2. Once AcraServer is deployed, it is ready to accept SQL requests.
3. You point the client-side application to the AcraServer instead of the SQL database.
4. On receiving SQL queries from the app, AcraServer parses each query and performs security operations: encryption, masking, tokenisation. To know which values to change, AcraServer uses a configuration file where you have described which columns should be encrypted, masked, tokenised.
5. After performing the operation, AcraServer passes the modified queries to the database, and the database response – back to the client application. Suppose you select to encrypt the email field: it means that original string is encrypted into cryptographic container and sent to the database as binary data.
6. When the client application wants to read the data, it sends a SELECT query to the AcraServer that sends it to the database.
7. Upon retrieving the database response, AcraServer tries to decrypt, demask, detokenise specified fields, and returns them to the application.
8. Application receives data in plaintext.

Except for data processing operations, AcraServer also analyses SQL queries: blocks the unwanted ones using the built-in configurable SQL firewall, detect SQL injections using poison records, sends logs and metrics, and alerts your Ops team in suspicious cases.

Check out the Guide: Integrating AcraServer into infrastructure to learn more about AcraServer features and how to use them.

Protecting data in any file storage using AcraTranslator

Let's see the simplest dataflow with AcraTranslator.

AcraTranslator works as Encryption-as-a-Service using HTTP and gRPC API. The application sends API request to the AcraTranslator with data fields and operations (encryption, decryption, tokenisation, detokenisation, etc). The application is responsible for storing the encrypted data in the database (NoSQL, KV store, SQL, AWS S3 – any) and communicating with AcraTranslator to decrypt it back.

AcraTranslator and AcraServer are fully independent server-side components and can be used together or separately depending on your infrastructure.

You have a client-side application that knows which fields to encrypt, decrypt, tokenise, and where to store them. You add AcraTranslator, and teach the application to perform API calls to use it.

This is what the process of writing and reading the data to/from a database looks like:

1. You deploy AcraTranslator in your infrastructure and configure TLS certificates.
2. Once AcraTranslator is deployed, it is ready to accept API requests.
3. Your application calls AcraTranslator and sends data fields and operations on them (encryption, decryption, tokenisation, detokenisation).
4. On receiving API requests, AcraTranslator performs the required operation and sends the result back to the app. Suppose the app sends the "email" field and "encrypt" operation. In that case, the original string is encrypted into cryptographic container and sent back to the app as binary data.
5. The application takes encrypted data and stores it in the database/datastore.
6. Once the application needs to get plaintext data, it reads encrypted data from the database/datastore, and sends an API request to the AcraTranslator. Suppose the app sends the "email" field and "decrypt" operation. In that case, the original data (binary blob) is decrypted to a string and sent to the app back.

Except for data processing operations, AcraTranslator also analyses API queries: detects intrusions using poison records, sends logs and metrics, and alerts your Ops team in suspicious cases.

Check out the Guide: Integrating AcraTranslator into infrastructure to learn more about AcraServer features and how to use them.

Availability

Compatibility and integration

Acra is a suite of components, most of them are "server-side", meaning that you deploy and configure AcraServer, AcraTranslator or AnyProxy, and connect your client-side application to them.

Acra components are compatible with numerous RDBMS, object and KV stores, cloud platforms, external key management systems (KMS), load balancing systems.

Cloud platforms	DigitalOcean, AWS, GCP, Heroku, any
RDBMS	MySQL v5.7+, PosgtreSQL v9.4-v11, MariaDB v10.3; Google Cloud SQL, Amazon RDS
Object stores	filesystems, KV databases, Amazon S3, Google Cloud DataStore
Load balancing	HAProxy, cloud balancers
Server-side platforms	Ubuntu, Debian, CentOS, RHEL; Docker
Client-side app language	any :)

Open source Acra has a limited integration support, more services are available in the Acra Enterprise Edition only.

Server-side

The server-side Acra components (AcraServer, AcraTranslator, AnyProxy) should run on separate servers/VMs for better isolation and compartmentalization. Key management utils and database helpers are usually run on the same server as AcraServer, AcraTranslator, AnyProxy.

The server-side Acra components run on most Linux distributives (Ubuntu, Debian, CentOS) and as Docker images. Note, the server-side Acra components are not compatible with Windows OS as host OS, consider using Docker.

See Getting started to learn how to install Acra or to try Acra without coding.

Client-side

Acra works with any client applications. No matter what languages you use to write your apps, you can connect them to AcraServer (via SQL) and AcraTranslator/AnyProxy (via API) to encrypt, decrypt, tokenise and mask the data.

Acra provides a set of client-side SDKs which are useful only in specific use cases:

• AcraWriter – SDK to encrypt data fields into AcraStructs. Use it when encrypting data on the app side is important (for building end-to-end encrypted dataflows or working in hostile environments).
• AcraReader – SDK to decrypt data fields from AcraStructs. Use it when decrypting data on the app side is important (for building end-to-end encrypted dataflows or working in hostile environments).
• SDK for AcraTranslator – SDK that encapsulates AcraTranslator's API for more convenient usage.

These SDKs are available for Ruby, Python, Go, C++, Node.js, iOS (Swift, ObjC), Android (Java, Kotlin), desktop Java and PHP.

Installation and launch

See Getting started to learn how to install Acra or to try Acra without coding.

Try Acra without writing code

Acra Example Projects illustrate the integration of Acra data protection suite into existing applications: web applications based on Django and Ruby on Rails frameworks, and simple CLI applications. We took well-known apps, detected sensitive data there and added the encryption layer. Protecting the data is completely transparent for the users and requires minimal changes in the infrastructure and application code.

Developers and Ops friendly:

• run a single command to deploy the application, database, Acra's components, logs, and dashboards;
• read the code changes and see how little it takes to integrate encryption into the client application;
• learn how Acra works by reading logs, monitoring metrics in Prometheus, checking tracers in Jaeger and watching Grafana dashboards;
• inspect Docker-compose files, architecture schemes, database tables, and much more.

Requirements: Linux or macOS with installed Docker.

⚙️ Run Acra Example Projects ⚙️

Documentation and tutorials

The most recent versions of the documentation, tutorials, and demos for Acra are available on the official Cossack Labs Documentation Server.

To gain an initial understanding of Acra, you might want to:

• What is Acra to get an overview of things.
• Acra's security controls to learn more about encryption, masking, tokenisation, SQL firewall, intrusion detections, etc.
• Typical dataflows that shows which Acra components you need and what are the Pros and Cons of each combination.
• Read the notes on Acra's architecture and security design to understand better what you get when you use Acra and what is the threat model that Acra operates in.

You can also check out the speaker slides for the following talks by Cossack Labs engineers:

• "Encryption Without Magic, Risk Management Without Pain" by Anastasiia Voitova.
• "Data encryption for Ruby web applications" by Dmytro Shapovalov.
• "Building SQL firewall(AcraCensor): insights from developers" by Artem Storozhuk.

Example projects

⚙️ Run Acra Example Projects ⚙️

GDPR, HIPAA, CCPA

Acra can help you comply with the current privacy regulations, such as:

• General Data Protection Regulation (GDPR)
• HIPAA (Health Insurance Portability and Accountability Act)
• DPA (Data Protection Act)
• CCPA (California Consumer Privacy Act)

Configuring and using Acra in a designated form will cover most of the demands described in articles 25, 32, 33, and 34 of GDPR and the PII data protection demands of HIPAA. Read more about Acra and Regulations.

Open source vs Enterprise

This is Acra Community Edition, the open source version of Acra, which is 💯 free for commercial and non-commercial usage. Please let us know in the Issues if you stumble upon a bug, see a possible enhancement, or have a comment on security design.

There are also Acra Enterprise Edition available. It provides better performance, redundancy/load balancing, comes pre-configured with crypto-primitives of your choice (FIPS, GOST), has integration with key/secret management tools in your stack, policy management, client-side SDKs, and have plenty of utils and tools for your Ops and SREs to operate Acra conveniently. Talk to us to get full feature lists and a quote.

Security consulting

It takes more than just getting cryptographic code to compile to secure the sensitive data. Acra won't make you “compliant out of the box” with all the modern security regulations, and no other tool will.

We help companies plan their data security strategy by auditing, assessing data flow, and classifying the data, enumerating the risks. We do the hardest, least-attended part of reaching the compliance – turning it from the “cost of doing business” into the “security framework that prevents risks”.

Contributing to us

If you’d like to contribute your code or provide any other kind of input to Acra, you’re very welcome. Your starting point for contributing is here.

Acra feedback

If you are an Acra user, please leave a short feedback.

License

Acra Community Edition is licensed as Apache 2 open-source software.

Contacts

If you want to ask a technical question, feel free to raise an Issue or write to [email protected].

To talk to the business wing of Cossack Labs Limited, drop us an email to [email protected].

acra's Issues

summarize cloud edition sprint

• management web console
• simplified connection mode
• integrated connection mode
• move acrastruct handling to Themis
• mongodb? (based on Hermes-base experience)

docs fixes

• Make install-build-run and quick-start one document
• Re-explain poison records, based on new changes
• Describe acra_rollback process
• Explain zone/default zone concept
• Outline Acra affecting PostgreSQL security measures
• Decscribe new keypair scheme
• Explain AcraWriter as a part of client code, elaborate on examples (integrating into ORM)
• Guidance regading app<>proxy, server <> db interfaces
• Enforce Client encrypts - server decrypts formulation everywhere
• Explain threat model and attack vectors (key stores are crown jewels), explain key db
• Trying Docker - clarify point on logging
• Integration tutorials - add at least some text of what's going on
• Installing AcraWriter
• Key management into separate document and describe paths for key storage

Cosmetic changes:

• Rewrite Wiki home
• Add availbility table
• Add table with links to all examples
• When you don't need Acra section in Wiki

Go/OS/Architecture compatibility table

Draft a table w/ Go version / OS / Architecture compatibility

Request filtering

Port Acra request filtering via pre-configured rules file to open-source version.

Test poison records with zone keys

installing acrawriter doc

Default zone

Working without zones is actually working with a default zone. We might want to unify the terminology at some point, and streamline the process on AcraServer side.

GoFMT before releasing!

Issues with examples

For the record in the wrappers - ruby has been updated to use the new begin tag but both nodejs and python are like php … they use the old one.

rollback decryption for injected acrastructs

pieces off #51

Make sure transport key is decoupled from default server key

add sqlalchemy wrappers to python/acrawriter

AcraStruct Whole Cell / Injected cell

--wholecell: consider acrastruct to occupy exactly one cell (default case, higher peformance)
--injectedcell: consider acrastruct to occupy any sub-sequence of byte stream (non-default case, use case: hiding the acrastruct in other data, including steganography and other weird stuff)

AcraServer web UI

This is for the very distant future - a ticket to accumulate all suggestions for Web UI to control AcraServer. Each suggestion will turn into separate issue.

[ ] Enable WebUI via port knocking
[ ] MFA Authenticate WebUI via side channel (OTP delivery integration)

Database convert exiting plaintext records to ciphertext

Hello,

I have got acra-connector and acra-server working and they're working as intended and encrypt and new entry for the columns that I choose.

I now want to convert the existing records of the table to ciphertext.

What's the simplest way I can convert my database with plaintext records to have ciphertext columns

Test code using golang 1.3

On all default debian machines apt get install golang 1.3

fall down after empty request

acraserver@acra-playground-02:~$ bin/acraserver --db_host=37.139.9.167 --db_port=55432 -v
\2017/02/15 11:28:32 Info: start listening 0.0.0.0:9393

2017/02/15 11:28:37 Info: new connection: 176.37.32.190:38026
fatal error: runtime: out of memory

runtime stack:
runtime.throw(0x964120, 0x16)
/usr/local/go/src/runtime/panic.go:530 +0x90
runtime.sysMap(0xc820200000, 0xfe000000, 0x0, 0xd84798)
/usr/local/go/src/runtime/mem_linux.go:206 +0x9b
runtime.(*mheap).sysAlloc(0xd6aae0, 0xfe000000, 0x0)
/usr/local/go/src/runtime/malloc.go:429 +0x191
runtime.(*mheap).grow(0xd6aae0, 0x7f000, 0x0)
/usr/local/go/src/runtime/mheap.go:651 +0x63
runtime.(*mheap).allocSpanLocked(0xd6aae0, 0x7f000, 0x419d01)
/usr/local/go/src/runtime/mheap.go:553 +0x4f6
runtime.(*mheap).alloc_m(0xd6aae0, 0x7f000, 0x100000000, 0xc820122000)
/usr/local/go/src/runtime/mheap.go:437 +0x119
runtime.(*mheap).alloc.func1()
/usr/local/go/src/runtime/mheap.go:502 +0x41
runtime.systemstack(0x7f3d863f3de8)
/usr/local/go/src/runtime/asm_amd64.s:307 +0xab
runtime.(*mheap).alloc(0xd6aae0, 0x7f000, 0x10100000000, 0xc820016000)
/usr/local/go/src/runtime/mheap.go:503 +0x63
runtime.largeAlloc(0xfdfff4ff, 0x1, 0x45e980)
/usr/local/go/src/runtime/malloc.go:766 +0xb3
runtime.mallocgc.func3()
/usr/local/go/src/runtime/malloc.go:664 +0x33
runtime.systemstack(0xc820016000)
/usr/local/go/src/runtime/asm_amd64.s:291 +0x79
runtime.mstart()
/usr/local/go/src/runtime/proc.go:1048

goroutine 18 [running]:
runtime.systemstack_switch()
/usr/local/go/src/runtime/asm_amd64.s:245 fp=0xc82002eb18 sp=0xc82002eb10
runtime.mallocgc(0xfdfff4ff, 0x7ba2c0, 0x1, 0x0)
/usr/local/go/src/runtime/malloc.go:665 +0x9eb fp=0xc82002ebf0 sp=0xc82002eb18
runtime.newarray(0x7ba2c0, 0xfdfff4ff, 0xc820120030)
/usr/local/go/src/runtime/malloc.go:798 +0xc9 fp=0xc82002ec30 sp=0xc82002ebf0
runtime.makeslice(0x7a9120, 0xfdfff4ff, 0xfdfff4ff, 0x0, 0x0, 0x0)
/usr/local/go/src/runtime/slice.go:32 +0x165 fp=0xc82002ec80 sp=0xc82002ec30
github.com/cossacklabs/acra/utils.ReadData(0x7f3d885310d8, 0xc820118000, 0x0, 0x0, 0x0, 0x0, 0x0)
/home/acraserver/src/github.com/cossacklabs/acra/utils/utils.go:73 +0x1b1 fp=0xc82002ed28 sp=0xc82002ec80
main.(*SServer).initSSession(0xc8200c6960, 0x7f3d88531000, 0xc820118000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
/home/acraserver/src/github.com/cossacklabs/acra/cmd/acraserver/listener.go:52 +0x92 fp=0xc82002ee78 sp=0xc82002ed28
main.(*SServer).handleConnection(0xc8200c6960, 0x7f3d88531000, 0xc820118000)
/home/acraserver/src/github.com/cossacklabs/acra/cmd/acraserver/listener.go:129 +0x139 fp=0xc82002ef98 sp=0xc82002ee78
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1998 +0x1 fp=0xc82002efa0 sp=0xc82002ef98
created by main.(*SServer).Start
/home/acraserver/src/github.com/cossacklabs/acra/cmd/acraserver/listener.go:159 +0x8da

goroutine 1 [IO wait]:
net.runtime_pollWait(0x7f3d88576b70, 0x72, 0x0)
/usr/local/go/src/runtime/netpoll.go:160 +0x60
net.(*pollDesc).Wait(0xc82004f2c0, 0x72, 0x0, 0x0)
/usr/local/go/src/net/fd_poll_runtime.go:73 +0x3a
net.(*pollDesc).WaitRead(0xc82004f2c0, 0x0, 0x0)
/usr/local/go/src/net/fd_poll_runtime.go:78 +0x36
net.(*netFD).accept(0xc82004f260, 0x0, 0x7f3d88576c30, 0xc82011c040)
/usr/local/go/src/net/fd_unix.go:426 +0x27c
net.(*TCPListener).AcceptTCP(0xc820022068, 0xc820043b10, 0x0, 0x0)
/usr/local/go/src/net/tcpsock_posix.go:254 +0x4d
net.(*TCPListener).Accept(0xc820022068, 0x0, 0x0, 0x0, 0x0)
/usr/local/go/src/net/tcpsock_posix.go:264 +0x3d
main.(*SServer).Start(0xc8200c6960)
/home/acraserver/src/github.com/cossacklabs/acra/cmd/acraserver/listener.go:153 +0x523
main.main()
/home/acraserver/src/github.com/cossacklabs/acra/cmd/acraserver/acraserver.go:132 +0xc8d

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1998 +0x1
acraserver@acra-playground-02:~$ \

Short/long args

-s --shutdown
-p --poison

etc.

process authentication

As we will need this is Hermes's ecosystem at some point, it's wise to study process authentication for platforms which enable it well.

Errors during parsing some PostgreSQL queries

Some service queries like "ROLLBACK" (used in transactions) and regular expressions in PostgreSQL can't be correctly handled by sql parser that we use in censor.

We use https://github.com/xwb1989/sqlparser that is not a best choice for PostgreSQL protocol.

Investigate binary builds and .deb/.rpm packaging

$subj :)

authenticate first connect request to acraserver

Random zone pools

Closer to ending existing line of problems, allow users to use Zones as source of Random keys.

• generateZonePool of size N for application XYZ
• getRandomZoneFromPool for application XYZ
• getZoneFromPool for application XYZ where zone_id is “ABC”

acra_rollback docs into wiki

describe acra_rollback script

Poison record verification

Don't check for poison records if no reaction is specified

Docs before release

[ ] Check every mark "Check/verify"
[ ] Check and revise key paths everywhere
[ ] Check zone stuff for consistency, duplicate into separate section
[ ] Check naming consistency everywhere
[ ] Throwaway keys > temp_writer / Temporary Writer keys
[ ] Zone ID is a context in SCell encryption, change

Add description about key naming to docs

Explain about key naming for acraproxy and acraserver (keys should be with "_server" prefix) in docs

SSL off for postgresql

Note in docs that acraserver work only without ssl on postgresql side. Now we have just one note in https://github.com/cossacklabs/acra/wiki/AcraProxy-and-AcraWriter , but it's important for acraserver too.

authenticated acraproxy

acraproxy authentication via cached token

Use new class/function names from pythemis in acrawriter

replace all names to new
now we have warning of usage old names

Add copyright and licence

// Copyright 2016, Cossack Labs Limited
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

... and commit Apache 2 license to root folder.

Error with a golang dependency when using Go 1.10

Hello, I'm trying to build Acra from sources but I'm failing at the first step of the guide which is to install acra-keymaker.

This is the error I get when I run go get github.com/cossacklabs/acra/cmd/acra-keymaker

ubuntu@ip-10-1-1-1:~/work/src/go.opencensus.io$ go get github.com/cossacklabs/acra/cmd/acra-keymaker
package go.opencensus.io/exporter/jaeger: cannot find package "go.opencensus.io/exporter/jaeger" in any of:
        /usr/lib/go-1.10/src/go.opencensus.io/exporter/jaeger (from $GOROOT)
        /home/ubuntu/work/src/go.opencensus.io/exporter/jaeger (from $GOPATH)

This got resolved when I downgraded go.opencensus.io/ from latest to v0.19.x because the package jaeger is moved to contrib.go.opencensus.io

Rename keypairs

Storage keys: acra_genkeys parameter: --storage; key name "someid_storage"
Client, server - leave intact

List authentication modes, which work which don't

https://www.postgresql.org/docs/9.1/static/auth-methods.html

benchmarks for initial release

For initial release documentation, I'd like us to have a final performance benchmark:

Measure reads:

• write very simple client app
• deploy Acra, first with one key, for 10000 random-length records:
  • measure speed of 100000 requests with decryption through Acra.
  • measure speed of 100000 requests passing through acra without decryption (no acrastruct)
• implement zone keys in test app, have 10000 records with 100 zone keys:
  • measure speed of 100000 requests with decryption through Acra
  • measure speed of 100000 requests without acrastruct
• point client to database directly, bypass acra/acraproxy, measure clean reads.

Measure writes:

• in client app, use generate 10000 acrastructs with random payload and single acra key, write to db, measure speed
• in client app, generate 10000 acrastructs with 100 different zone keys, write to db, measure speed
• in client app, write 10000 plain writes with random payload

For test purposes, use full environment:

• 1 machine w/ client code, AcraProxy, AcraWriter
• 1 machine with AcraServer
• 1 machine w/ PgSQL

Generate two key pairs via acra_genkeys

By default create keys for acraproxy and acraserver but add option for generating one of.

Poison record rotation

Think about this closer to 1.0, talk to users.

If we do:

When triggered poison record rotation:

• acraserver generates new poison records
• user feeds select that triggers poison records
• acra reads output, replaces poison records with old keys with poison records with new keys, generates a dump of inserts.
• user receives sql commands and is able to run it / server runs it for user?

Flush caches on AcraServer

Deleting .acrakeys on server side does not affect server's behavior (keys are cached in memory), so we have to provide a way to flush caches.

Is SQL Server planned in the future?

The list of supported databases is impressive. Is Microsoft SQL Server support planned? As well as the Azure SQL Server service?

Add examples without Zones for PHP and Node

Remove debug logs from acra_rollback and unify log output logic across all cmd utils

move log writers from cmd/acraserver to cmd/utils and use this general writers in all cmd utils for filtering logs output

Different trust levels

Light: SSL (instead of SS) and lighter integration.
Hardcore: Deeper integration into app runtime and secret protection.

Adding data type to encrypted column in AcraServer encryption configuration

issues:

In the documentation, this is mentioned :

Transparent encryption proxy mode allows you to configure AcraServer to encrypt records in specific database columns without altering the application code.

However, There is not possibility for my not editable application to work with this proxy as :

Encrypted data is binary data. As AcraServer doesn't know the nature of data, it returns the decrypted binary data to the web app. You’ll need to change the source code of your web app for the app to expect the decrypted data as binary, then to encode it into the original format (strings, numbers, bytes, etc.).

Expected behaviour :

As a transparent proxy user , I expect to have to define the database field type either in the acra server/connector configuration and in the database (change encrypted field into binary field) but not in the application code.

Regards,

Auto appending sslmode=disable param in acra_rollback

because it's required param, we can check for it ourselves and automatically add if user didn't pass him

split poison_key path from other keys

now key pair for poison records has filename poison_key<.pub>. Now possible intersection of client's key names and poison record.
simple way is placing poison keypair into subdirectory

CLI args to .conf file

• Move all CLI arguments to conf file
• Separate conf file for every piece of Acra
• Scan source code for CLI arguments that were not documented

AcraCloud: Admin/instance config UI

Interface, that allows to configure (generate configuration, attach storage) and fire up a new instance.

add goreport card

• prior to release, run through goreporto and add goreport card to readme

make -help consistent with the docs

acraserver help, show -- for long, - for short.

prepare acraserver dockerization for github version