TMA-OCEANBASE-3.2.3

Limit Accepted TLS Versions

AltaNivel 2Automatizadaoceanbase

Descripción

OceanBase supports communication encryption to ensure that traffic between nodes cannot be eavesdropped or tampered with. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when sql_protocol_min_tls_version is TLSv1.2 or TLSv1.3 on all OBServer nodes (none, any, TLSv1 or TLSv1.1 fail). Mismatched values across nodes fail because each row is checked.

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN COUNT(*) > 0 AND SUM(CASE WHEN value IN ('TLSv1.2', 'TLSv1.3') THEN 0 ELSE 1 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name = 'sql_protocol_min_tls_version'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

ALTER SYSTEM SET sql_protocol_min_tls_version = 'TLSv1.2'; (or 'TLSv1.3') and confirm the value on every OBServer with SHOW PARAMETERS LIKE 'sql_protocol_min_tls_version';

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: oceanbasetls
Referencia: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.2.3 Limit Accepted TLS Versions

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target oceanbase --level 2