Security Guide
TDengine provides multi-layer security for production environments, covering identity authentication and authorization, transport encryption, access control, data-at-rest protection, operational auditing, and hardening suggestions for each component. The Enterprise edition delivers full capabilities for user permissions (including RBAC / separation of duties), IP whitelisting, audit, transparent encryption, and tokens; the Community edition provides a subset of basic capabilities—see each topic for details.
This chapter is organized by security capability:
- Authentication and Authorization: security overview for users, privileges, and RBAC; refer to the SQL manual for syntax and privilege matrices.
- Transport Security: server certificates and taosAdapter SSL/TLS configuration.
- Data Security: IP whitelisting, secure delete (
SECURE_DELETE), and transparent data encryption (TDE). - Connector Security: client SSL/TLS, token authentication, and dynamic rotation.
- Audit and Compliance: audit configuration, log access, and security-advisory linkage.
- Security Deployment Configuration Suggestions: component exposure, hardening, and gateway deployment.
- Security Advisories: known vulnerabilities, affected versions, and fixed versions.
📄️ Authentication and Authorization
Overview of TDengine user authentication and access control; full syntax is in the SQL user and privilege manuals
📄️ Transport Security
TDengine server-side SSL/TLS certificate generation and taosAdapter configuration
📄️ Data Security
TDengine TSDB Enterprise IP whitelist, secure delete, and transparent data encryption (TDE)
📄️ Connector Security
TDengine connector SSL/TLS, token authentication, and dynamic rotation practices
📄️ Audit and Compliance
TDengine audit log configuration and viewing, plus security advisory entry points
📄️ Security Deployment Suggestions
Exposure surface of TDengine components and production hardening suggestions
📄️ Security Advisories
TDengine product security vulnerability advisories and fix information