TMA-TDSQL-11.1
Ensure ZooKeeper ACLs Are Enabled
HighLevel 1Automatedtdsql
Description
TDSQL uses ZooKeeper to store cluster metadata, configuration information, and to coordinate node state. ZooKeeper ACLs (Access Control Lists) control access to ZNodes. Uses TDSQL_HOME (install directory with bin/, conf/, boot/, log/; default /data/tdsql); reads <TDSQL_HOME>/conf/scheduler.xml and passes when <zookeeper> has safeacl="1". Also confirm with zkCli.sh getAcl /tdsql that the ACL is not world:anyone:cdrwa.
How it is checked
Audit method: Shell command
shell
f="${TDSQL_HOME:-/data/tdsql}/conf/scheduler.xml"; [ -r "$f" ] || exit 1; if grep -Eo '<zookeeper[^>]*' "$f" | grep -Eq '[[:space:]]safeacl="1"'; then echo compliant; else echo noncompliant; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set safeacl="1" on the <zookeeper> element of scheduler.xml, configure digest ACLs with a strong random credential and restart the affected components.
Properties
- Operating systems
- Any
- Tags
- tdsqlzookeeper
- Reference
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.1 Ensure ZooKeeper ACLs Are Enabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target tdsql