TDSQL
TMA-TDSQL-1.8
Ensure Unnecessary System Services Are Disabled on TDSQL Hosts
LowLevel 2Manual reviewtdsql
Description
TDSQL hosts should run only the necessary services. Unnecessary services increase the attack surface.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run systemctl list-unit-files --type=service --state=enabled and ss -tlnp on every TDSQL host. Only TDSQL components (mysqld, oss_server, scheduler, zookeeper, gateway/proxy, agents) and required OS services may be enabled or listening; services such as cups, avahi-daemon, bluetooth or telnet are a finding.
How it is fixed
Fix method: Guidance or infrastructure patch
# Disable unnecessary services systemctl disable --now cups avahi-daemon bluetooth telnet.socket
Properties
- Operating systems
- Any
- Tags
- tdsqlos
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.8 Ensure Unnecessary System Services Are Disabled on TDSQL Hosts