Ensure Passwords Are Not Passed via the Command Line

AltaNivel 1Automatizadatdsql

Descripción

When using the MySQL client or TDSQL tools, passwords should not be specified via the command-line arguments -p<password> or --password=. Counts running MySQL client processes and shell-history entries that pass a password inline (-p<password> or --password=). Restricted to MySQL client tools to avoid false matches such as mkdir -p.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(ps -eo args= 2>/dev/null) || exit 1; p=$(printf '%s\n' "$out" | grep -v tdsql_cli_pw_audit | grep -cE '(mysql|mysqladmin|mysqldump|mysqlbinlog|mysqlsh)[^|;]*[[:space:]](-p[^[:space:]]|--password=)' || true); h=$(cat /root/.bash_history /home/*/.bash_history 2>/dev/null | grep -cE '(mysql|mysqladmin|mysqldump|mysqlbinlog|mysqlsh)[^|;]*[[:space:]](-p[^[:space:]]|--password=)' || true); echo $((p + h)) # tdsql_cli_pw_audit

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Use a MySQL option file (~/.my.cnf with [client] user/password, mode 600) or the TDSQL encrypted credential system instead of -p<password>; clear affected shell history entries and rotate any exposed passwords.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: tdsqlcredentials
Referencia: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.5 Ensure Passwords Are Not Passed via the Command Line

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target tdsql