Connections made to the SAS Infrastructure Data Server (the PostgreSQL database) use network encryption. The current list of accepted ciphers includes deprecated and non-compliant ciphers.  

If your company requires the use of more current encryption methods, you can manually modify the PostgreSQL configuration file to update the ciphers that are accepted.

Use these instructions to manually update the accepted ciphers on Linux and Microsoft Windows systems.

Linux Instructions

1. Stop the consul-template service for the postgresql.conf file by executing the following commands using a sudoer account:
   • cd /etc/init.d
   • sudo ./sas-viya-sasdatasvrc-<cluster-name>-<node-name>-ct-postgresql stop
     • Here is an example: sudo ./sas-viya-sasdatasvrc-postgres-node0-ct-postgresql stop
2. Update the postgresql.conf file:
   1. Execute the following commands as the sas user:
      • cd /opt/sas/viya/config/data/sasdatasvrc/<cluster-name>/<node-name> 
        • Here is an example: cd /opt/sas/viya/config/data/sasdatasvrc/postgres/node0 
      • cp postgresql.conf postgresql.conf.bk
      • vi postgresql.conf
   2. Add the following entries at the bottom of the postgresql.conf file and save the file:

3. Use the diff command to compare files to validate that the changes were made:
   • diff postgresql.conf postgresql.conf.bk

4. Start the consul-template service for the postgresql.conf file by executing the following commands with a sudoer account:
   • cd /etc/init.d
   • sudo ./sas-viya-sasdatasvrc-<cluster-name>-<node-name>-ct-postgresql start
     • Here is an example: sudo ./sas-viya-sasdatasvrc-postgres-node0-ct-postgresql start
5. Complete steps 1 - 4 for all data nodes for the cluster.
6. Restart the cluster in order to make the new setting effective:
   1. Log on to the PGPool host.
   2. Execute the following commands using a sudoer account:
      • cd /etc/init.d
      • sudo ./sas-viya-sasdatasvrc-<cluster-name> restart
        • Here is an example: sudo ./sas-viya-sasdatasvrc-postgres restart

Windows Instructions

1. Stop the Windows service named SAS Infrastructure Data Server - Postgres - Datanode0.
2. Update the postgresql.conf file:
   1. Using Windows Explorer, go to C:\ProgramData\SAS\Viya\data\sasdatasvrc\<cluster-name>\node0.
      • Here is an example: C:\ProgramData\SAS\Viya\data\sasdatasvrc\postgres\node0
   2. Copy the postgresql.conf file to the postgresql.conf.bk folder.
   3. Edit the postgresql.conf file as an administrator, add the following, and save.
      Note: You might need to use PowerShell to complete this step.

4. Confirm the changes. You can do this with a command-line tool such as fc.exe:
   • Here is an example: fc.exe postgresql.conf postgresql.conf.bk

3. Start the Windows service named SAS Infrastructure Data Server - Postgres - Datanode0.

Operating System and Release Information