Ensure Sensitive Configuration Data Is Encrypted

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

# Check for cleartext passwords in the configuration grep -rn 'password' /path/to/tdsql/conf/ | grep -v '#' | head -20 # Encrypted passwords appear as long base64-encoded strings. # Short, simple cleartext strings indicate unencrypted passwords.

How it is fixed

Fix method: Guidance or infrastructure patch

Encrypt all passwords using TDSQL's encryption tools. Ensure the master key used for encryption is stored separately from the encrypted data and managed by an independent key management process. Integrating with a KMS is strongly recommended. Encryption process overview: 1.