celticht32 Couchbase Security Hardening
A skill for hardening Couchbase deployments — TLS, RBAC, audit logging, encryption at rest, external authentication, network isolation, and compliance alignment.
Distinct from:
couchbase-mcp— calling the security tools (admin_user_*,admin_encryption_*, etc.)couchbase-app-integration— TLS/mTLS configuration in SDK client code
When this skill applies
- "How do I secure Couchbase for production?"
- "How do I set up TLS / enforce TLS-only connections?"
- "How do I integrate Couchbase with LDAP / Active Directory?"
- "How do I design RBAC for my team?"
- "What audit logging should I enable?"
- "How do I enable encryption at rest (DARE)?"
- "What's KMIP and when do I need it?"
- "How do I harden Couchbase for SOC2 / HIPAA / PCI?"
- "How do I configure password policy and account lockout?"
Pick the right reference
| Question | Read |
|---|---|
| "TLS — enabling, certificate rotation, enforcing TLS-only, mTLS" | references/tls.md |
| "RBAC — role design, least-privilege, service accounts, group structure" | references/rbac.md |
| "External auth — LDAP, Active Directory, SAML, PAM" | references/external-auth.md |
| "Audit logging — what to enable, log rotation, SIEM integration" | references/audit-logging.md |
| "Encryption at rest — DARE, KMIP, key rotation" | references/encryption-at-rest.md |
| "Network hardening — ports, firewall rules, node-to-node TLS" | references/network-hardening.md |
Security hardening checklist
Before going to production, verify all of these:
Authentication & access:
- Default
Administratorpassword changed from the default - All application connections use dedicated service accounts (not Administrator)
- All service accounts have minimum required roles only
- RBAC groups defined so roles are assigned via group, not per-user
- Password policy configured (min length ≥ 12, complexity, rotation)
- Account lockout enabled (8.x:
admin_user_lockout_settings) - External auth (LDAP/AD) configured if your organization requires centralized identity
Network & encryption:
- TLS enabled and TLS 1.2+ enforced (TLS 1.0 / 1.1 disabled)
- Node-to-node encryption enabled (cluster internal traffic)
- All client SDK connections use
couchbases://(TLS) - Ports restricted to Couchbase service ports only (see
network-hardening.md) - Cluster nodes on a private network, not directly internet-accessible
- Capella: allowed CIDRs configured; no 0.0.0.0/0
Data protection:
- Encryption at rest (DARE) enabled if required by compliance
- KMIP configured if your org requires external key management
- Backup encryption enabled (cbbackupmgr
--encrypted)
Audit & visibility:
- Audit logging enabled
-
admin_loggedInandadmin_loggedOutevents captured -
mutateDocumentevents captured for sensitive collections - Audit log rotation and retention configured
- Audit logs shipped to SIEM
Quick tool map
| Task | Tool |
|---|---|
| Get current security settings | admin_cluster_get_security_settings |
| Update security settings (TLS, sessions) | admin_cluster_update_security_settings |
| Configure password policy | admin_cluster_set_password_policy |
| Get/update auto-failover (security adjacent) | admin_cluster_get_auto_failover_settings |
| User management | admin_user_* |
| Group management | admin_group_* |
| List roles | admin_user_list_roles |
| Check current user permissions | admin_user_check_permissions |
| Encryption settings (DARE) | admin_encryption_get_settings, admin_encryption_update_settings |
| KMIP configuration | admin_kmip_* |
| Audit log configuration | admin_cluster_get_audit_config, admin_cluster_update_audit_config |
| User lockout (8.x) | admin_user_lock, admin_user_unlock, admin_user_get_lockout_settings |
Related skills
couchbase-mcp— the actual security toolscouchbase-app-integration— TLS/mTLS configuration in application SDK clientscouchbase-observability— shipping audit logs and security metrics to monitoring systemscouchbase-backup-restore— backup encryption configuration