Restrict Access Using Host-Based Authentication

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; Rules must list only approved IP addresses/CIDRs for each user and end with a rule that rejects everything else (e.g. host all all all reject). An empty value (the default, equivalent to host all all all cert-password) or broad 0.0.0.0/0 rules is a finding.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Define explicit whitelisted origins Construct an HBA configuration that lists only authorized IP ranges or hosts. For example: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all jump_user 203.0.113.10/32 password host all app_user 198.51.100.0/24 password host all all all reject ';