TMA-TDSQL-11.1

Ensure ZooKeeper ACLs Are Enabled

AltaNivel 1Automatizadatdsql

Descripción

TDSQL uses ZooKeeper to store cluster metadata, configuration information, and to coordinate node state. ZooKeeper ACLs (Access Control Lists) control access to ZNodes. Uses TDSQL_HOME (install directory with bin/, conf/, boot/, log/; default /data/tdsql); reads <TDSQL_HOME>/conf/scheduler.xml and passes when <zookeeper> has safeacl="1". Also confirm with zkCli.sh getAcl /tdsql that the ACL is not world:anyone:cdrwa.

Cómo se verifica

Método de auditoría: Comando de shell

shell

f="${TDSQL_HOME:-/data/tdsql}/conf/scheduler.xml"; [ -r "$f" ] || exit 1; if grep -Eo '<zookeeper[^>]*' "$f" | grep -Eq '[[:space:]]safeacl="1"'; then echo compliant; else echo noncompliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set safeacl="1" on the <zookeeper> element of scheduler.xml, configure digest ACLs with a strong random credential and restart the affected components.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: tdsqlzookeeper
Referencia: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.1 Ensure ZooKeeper ACLs Are Enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target tdsql