Data Masking

Data Masking hides sensitive values in the result sets returned when users connect to database assets. A rule selects the columns to mask and the masking method, so users can run queries without seeing full values such as passwords, secrets, or personal identifiers.

Open the page from Console > ACLs > Data Masking.

Figure 1: Create data masking rule with column pattern, masking method, and mask pattern.

Overview

A masking rule combines a scope (users, assets, and accounts) with a field pattern and a masking method. It applies only to database connections; other asset types are not affected. The rules are scoped to the current organization and are matched by priority, where a lower number is evaluated earlier.

Before you begin

Sign in with an account that can manage ACLs.
Have at least one database asset and its accounts in the current organization.
Know which column names should be masked. Check the actual schema first, since the rule matches column names, not column positions.

Create a data masking rule

Click Create.

In the Create data masking drawer, fill in the fields below.

Click Submit.

Field reference

Group	Field	Description
Basic	Name	Required. Rule name, unique within the organization.
Basic	Priority	Integer from 1 to 100. Defaults to 50; the lower the value, the earlier the rule is matched.
Users	Users	All users, Specified users, or Attribute filter.
Assets	Assets	All assets, Specified assets, or Attribute filter.
Accounts	Accounts	All accounts or Specified accounts.
Rules	Fields pattern	Column names to mask. Supports comma-separated names and the `*` wildcard. Defaults to `password`.
	Masking method	Fixed Character Replacement, Hide Middle Characters, Keep Prefix Only, or Keep Suffix Only.
	Mask pattern	Replacement text used by Fixed Character Replacement, for example `######`.
Other	Active	When selected, the rule takes effect.
Other	Comment	Optional.

Fields pattern examples

Pattern	Columns masked
`password`	Only the column named `password`.
`password,secret`	The `password` and `secret` columns.
`password*`	Columns whose names start with `password`.
`.*password`	Columns whose names end with `password`.

Note

Masking changes only the result that the user sees. The data stored in the database is not modified, and applications that connect outside JumpServer are not affected. Combine this rule with Authorizations that limit which accounts and protocols can reach the database.

#Data Masking

#Overview

#Before you begin

#Create a data masking rule

#Field reference

#Fields pattern examples