TDengine TSDB Security Configuration Guide

Juno Qiu

July 5, 2026 / Time-Series Database Essentials-1

Data security is essential for production TSDB deployments. TDengine provides controls for IP whitelisting, audit logs, and encryption at rest.

IP whitelisting

IP whitelisting controls which hosts can access the database.

Configuration

CREATE USER testuser PASS 'password' HOST '192.168.1.0/24';

ALTER USER testuser ADD HOST '10.0.0.0/8';

Querying the whitelist

SELECT USER, ALLOWED_HOST FROM INFORMATION_SCHEMA.INS_USERS;

SHOW USERS;

Removing whitelist entries

ALTER USER testuser DROP HOST '192.168.1.0/24';

Important notes

Item	Description
Open-source edition limitation	The open-source edition allows configuration but does not enforce it
Cluster consistency	The whitelist must be consistent across all cluster nodes
Automatic addition	Cluster node IPs are automatically added to the whitelist
Default allowance	127.0.0.1 is in the whitelist by default

Audit logs

Audit logs record user operations so administrators can review security events and trace historical activity.

Enabling the audit function

In the taosd configuration file (taos.cfg), set the following parameters:

audit 1
auditLevel 3
monitorFqdn localhost
monitorPort 6043

Creating an audit database

CREATE DATABASE audit_db IS_AUDIT 1;

Audit log structure

Audit logs use JSON format with the following fields: ts, user, operation, db, resource, client_address, details.

Viewing audit logs

Via taosExplorer: System Management, Audit, View Audit Logs.

Via CLI:

SELECT * FROM audit_db.operations;

Encryption at rest

TDengine supports Transparent Data Encryption (TDE) to reduce the risk of data exposure from storage media or copied data files.

Generating keys

taosk -c /etc/taos --set-cfg-algorithm sm4 --set-meta-algorithm sm4 --encrypt-server --encrypt-database --encrypt-config --encrypt-metadata --encrypt-data

Checking encryption status

SELECT * FROM INFORMATION_SCHEMA.INS_ENCRYPT_STATUS;

Backing up keys

taosk -c /etc/taos --backup --svr-key your_key

Encryption algorithms

Algorithm	Description
SM4	SM4 block cipher algorithm (default)
AES-128-CBC	AES-128-CBC block cipher algorithm

Security deployment recommendations

Network layer

Configure firewall rules
Use VPC (Virtual Private Cloud) for network isolation
Enable IP whitelisting

Access control

Apply the principle of least privilege
Rotate passwords regularly
Enable audit logs

Data protection

Enable encryption at rest
Perform regular data backups
Configure replica strategies

Summary

TDengine Enterprise Edition provides several security controls:

IP whitelisting restricts allowed access sources
Audit logs record user operations
Transparent Data Encryption protects data at rest
Use these controls together rather than relying on a single security mechanism