Ensure CockroachDB Cluster is Initialized Securely with TLS

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run ps -ef | grep "[c]ockroach start": --insecure must not appear (--accept-sql-without-tls is also a weakness). Verify the certs directory (e.g. /var/lib/cockroach/certs) contains ca.crt, node.crt/node.key and client certificates, is owned by cockroach, and that the CA key is kept off the nodes. Confirm cockroach sql --insecure is rejected.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Generate the cluster Certificate Authority (CA): The documentation suggests creating two directories on your local machine: certs (for public files) and my-safe-directory (for the private CA key). On a secure workstation: # Create directories for certificates # `certs` : You'll generate your CA certificate and all node and client certificates and keys in this directory.