TMA-COCKROACHDB-3.3
Ensure Connection Authentication Logging Is Enabled
Description
CockroachDB can log client connection attempts, successful logins, authentication failures, and session disconnections through the SESSIONS logging channel. By default, this channel's logging is disabled to minimize overhead on all clusters. Runs cockroach sql with --certs-dir ${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs} (a root or admin client certificate must be in it); the target node comes from COCKROACH_HOST (default localhost:26257) or COCKROACH_URL. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when server.auth_log.sql_connections.enabled and server.auth_log.sql_sessions.enabled are both true.
How it is checked
Audit method: SQL query
out=$(cockroach sql --certs-dir="${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs}" --format=csv --execute "SHOW CLUSTER SETTING server.auth_log.sql_connections.enabled; SHOW CLUSTER SETTING server.auth_log.sql_sessions.enabled;" 2>/dev/null) || exit 1; printf '%s\n' "$out" | grep -cx true || true- Expected output
2
How it is fixed
Fix method: Guidance or infrastructure patch
SET CLUSTER SETTING server.auth_log.sql_connections.enabled = true; SET CLUSTER SETTING server.auth_log.sql_sessions.enabled = true; and keep the SESSIONS channel routed to cockroach-sql-auth.log.
Properties
- Operating systems
- Any
- Tags
- cockroachdbloggingauthentication
- Reference
- CIS CockroachDB v25.x Benchmark v1.0.0 - 3.3 Ensure Connection Authentication Logging Is Enabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target cockroachdb