Deployment considerations

There are a number of things to consider before deploying Postgres Enterprise Manager.

Considerations	Implementation instructions
Is a standalone server sufficient or do you need a high availability architecture?	Installing the server or Query information
Do you need to implement connection pooling?	Deploying connection pooling
What type of authentication to use?	Authentication options
What actions should you take to avoid security vulnerabilities?	Securing your deployment
Where to host the Apache web server?	Web server installation options

• Using Failover Manager for high availability
  • Initial product installation and configuration
  • Set up the primary node for streaming replication
  • Set up the standby nodes for streaming replication
  • Set up EFM to manage failover on all hosts
  • Current limitations
• Connection pooling using pgBouncer
  • PEM server and agent connection management mechanism
  • Preparing the PEM database server
  • Configuring PgBouncer
  • Configuring the PEM agent
    • Configuring a new PEM agent (installed via RPM)
    • Configuring an existing PEM agent (installed via RPM)
• Authentication options
  • Configuring the PEM server to use Kerberos authentication
    • 1. Install Kerberos, the PEM server, and the PEM backend database
    • 2. Add principals on Kerberos server
    • 3. Extract key tables from Kerberos server
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use Windows Active Directory domain services for Kerberos authentication (SSPI)
    • 1. Install Active Directory, the PEM server, and the PEM backend database server
    • 2. Create users in Active Directory to map with service principals
    • 3. Extract key tables from Active Directory
    • 4. Configure the PEM backend database server
    • 5. Obtain and view the initial ticket
    • 6. Configure the PEM server
    • 7. Browser settings
  • Configuring the PEM server to use two-factor authentication
    • Mail server configuration
• Securing your deployment
  • Apache HTTPD security configurations
    • Disable SSLv2 and SSLv3
    • Secure HTTPD with SSL certificates
    • Disable web server information exposure
    • Disable directory listing
    • Restrict the access to a network or IP address
    • Cross-site tracing
    • Run web server from a nonprivileged user account
    • Customize security HTTP headers in PEM web server
    • Host header injection attacks
  • PEM application security configurations
    • Session timeout
    • RestAPI header customization
    • Role-based access control in PEM
    • SQL/Protect plugin
    • Password management
    • Run pemAgent jobs with a non-root user
    • Changing the pemAgent and PEM backend database server certificates
• Web server installation options
  • PEM server and Apache web server on separate hosts