Limit Accepted TLS Versions

HighLevel 2Automatedoceanbase

Description

OceanBase supports communication encryption to ensure that traffic between nodes cannot be eavesdropped or tampered with. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when sql_protocol_min_tls_version is TLSv1.2 or TLSv1.3 on all OBServer nodes (none, any, TLSv1 or TLSv1.1 fail). Mismatched values across nodes fail because each row is checked.

How it is checked

Audit method: SQL query

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN COUNT(*) > 0 AND SUM(CASE WHEN value IN ('TLSv1.2', 'TLSv1.3') THEN 0 ELSE 1 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name = 'sql_protocol_min_tls_version'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

ALTER SYSTEM SET sql_protocol_min_tls_version = 'TLSv1.2'; (or 'TLSv1.3') and confirm the value on every OBServer with SHOW PARAMETERS LIKE 'sql_protocol_min_tls_version';

Properties

Operating systems: Any
Tags: oceanbasetls
Reference: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.2.3 Limit Accepted TLS Versions

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target oceanbase --level 2