# Couchbase Security Hardening

> Harden and audit Couchbase security posture for production deployments. Use whenever the user asks about TLS configuration, mTLS, certificate management, LDAP integration, SAML, PAM authentication, audit logging, audit log configuration, network isolation, firewall rules for Couchbase, RBAC design, least-privilege, password policy, account lockout (8.x), encryption at rest (DARE), KMIP key manage…

- **Type:** Skill
- **Install:** `agentstack add skill-celticht32-couchbase-skills-for-claude-ai-couchbase-security-hardening`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [celticht32](https://agentstack.voostack.com/s/celticht32)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [celticht32](https://github.com/celticht32)
- **Source:** https://github.com/celticht32/Couchbase-Skills-for-Claude.ai/tree/main/skills/couchbase/couchbase-security-hardening

## Install

```sh
agentstack add skill-celticht32-couchbase-skills-for-claude-ai-couchbase-security-hardening
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Couchbase Security Hardening

A skill for *hardening* Couchbase deployments — TLS, RBAC, audit logging, encryption at rest, external authentication, network isolation, and compliance alignment.

Distinct from:
- `couchbase-mcp` — calling the security tools (`admin_user_*`, `admin_encryption_*`, etc.)
- `couchbase-app-integration` — TLS/mTLS configuration in SDK client code

## When this skill applies

- "How do I secure Couchbase for production?"
- "How do I set up TLS / enforce TLS-only connections?"
- "How do I integrate Couchbase with LDAP / Active Directory?"
- "How do I design RBAC for my team?"
- "What audit logging should I enable?"
- "How do I enable encryption at rest (DARE)?"
- "What's KMIP and when do I need it?"
- "How do I harden Couchbase for SOC2 / HIPAA / PCI?"
- "How do I configure password policy and account lockout?"

## Pick the right reference

| Question | Read |
|---|---|
| "TLS — enabling, certificate rotation, enforcing TLS-only, mTLS" | `references/tls.md` |
| "RBAC — role design, least-privilege, service accounts, group structure" | `references/rbac.md` |
| "External auth — LDAP, Active Directory, SAML, PAM" | `references/external-auth.md` |
| "Audit logging — what to enable, log rotation, SIEM integration" | `references/audit-logging.md` |
| "Encryption at rest — DARE, KMIP, key rotation" | `references/encryption-at-rest.md` |
| "Network hardening — ports, firewall rules, node-to-node TLS" | `references/network-hardening.md` |

## Security hardening checklist

Before going to production, verify all of these:

**Authentication & access:**
- [ ] Default `Administrator` password changed from the default
- [ ] All application connections use dedicated service accounts (not Administrator)
- [ ] All service accounts have minimum required roles only
- [ ] RBAC groups defined so roles are assigned via group, not per-user
- [ ] Password policy configured (min length ≥ 12, complexity, rotation)
- [ ] Account lockout enabled (8.x: `admin_user_lockout_settings`)
- [ ] External auth (LDAP/AD) configured if your organization requires centralized identity

**Network & encryption:**
- [ ] TLS enabled and TLS 1.2+ enforced (TLS 1.0 / 1.1 disabled)
- [ ] Node-to-node encryption enabled (cluster internal traffic)
- [ ] All client SDK connections use `couchbases://` (TLS)
- [ ] Ports restricted to Couchbase service ports only (see `network-hardening.md`)
- [ ] Cluster nodes on a private network, not directly internet-accessible
- [ ] Capella: allowed CIDRs configured; no 0.0.0.0/0

**Data protection:**
- [ ] Encryption at rest (DARE) enabled if required by compliance
- [ ] KMIP configured if your org requires external key management
- [ ] Backup encryption enabled (cbbackupmgr `--encrypted`)

**Audit & visibility:**
- [ ] Audit logging enabled
- [ ] `admin_loggedIn` and `admin_loggedOut` events captured
- [ ] `mutateDocument` events captured for sensitive collections
- [ ] Audit log rotation and retention configured
- [ ] Audit logs shipped to SIEM

## Quick tool map

| Task | Tool |
|---|---|
| Get current security settings | `admin_cluster_get_security_settings` |
| Update security settings (TLS, sessions) | `admin_cluster_update_security_settings` |
| Configure password policy | `admin_cluster_set_password_policy` |
| Get/update auto-failover (security adjacent) | `admin_cluster_get_auto_failover_settings` |
| User management | `admin_user_*` |
| Group management | `admin_group_*` |
| List roles | `admin_user_list_roles` |
| Check current user permissions | `admin_user_check_permissions` |
| Encryption settings (DARE) | `admin_encryption_get_settings`, `admin_encryption_update_settings` |
| KMIP configuration | `admin_kmip_*` |
| Audit log configuration | `admin_cluster_get_audit_config`, `admin_cluster_update_audit_config` |
| User lockout (8.x) | `admin_user_lock`, `admin_user_unlock`, `admin_user_get_lockout_settings` |

## Related skills

- `couchbase-mcp` — the actual security tools
- `couchbase-app-integration` — TLS/mTLS configuration in application SDK clients
- `couchbase-observability` — shipping audit logs and security metrics to monitoring systems
- `couchbase-backup-restore` — backup encryption configuration

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [celticht32](https://github.com/celticht32)
- **Source:** [celticht32/Couchbase-Skills-for-Claude.ai](https://github.com/celticht32/Couchbase-Skills-for-Claude.ai)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-celticht32-couchbase-skills-for-claude-ai-couchbase-security-hardening
- Seller: https://agentstack.voostack.com/s/celticht32
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.