Ensure No Users Have Wildcard Hostnames

AltaNivel 2Automatizadaoceanbase

Descripción

All user accounts in the database should be strictly restricted to connect only from specific hosts or IP addresses explicitly required for their business operations. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when no account has host '%' (the defaults root@% and ORAAUDITOR@% fail until restricted).

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT COUNT(*) FROM mysql.user WHERE host = '%'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

RENAME USER '<user>'@'%' TO '<user>'@'<approved host or subnet>'; for every account returned.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: oceanbaseauthenticationnetwork
Referencia: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.1.7 Ensure No Users Have Wildcard Hostnames

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target oceanbase --level 2