Ensure password_encryption is set to scram-sha-256

AltaNivel 1Automatizadayugabytedb

Descripción

The password_encryption parameter controls the algorithm used to hash passwords set by CREATE ROLE and ALTER ROLE statements. When set to md5 or on (which maps to md5), passwords are stored using MD5 which is cryptographically weak. Setting this to scram-sha-256 ensures passwords are stored using SCRAM-SHA-256, which provides strong security against offline password cracking attacks. Runs ysqlsh (add the YugabyteDB bin directory to PATH) against PGHOST/PGPORT (default 127.0.0.1:5433) as PGUSER (default yugabyte); supply the password through PGPASSWORD or ~/.pgpass.

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

out=$(ysqlsh -h "${PGHOST:-127.0.0.1}" -p "${PGPORT:-5433}" -U "${PGUSER:-yugabyte}" -d "${PGDATABASE:-yugabyte}" -tAc "SHOW password_encryption" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Salida esperada: scram-sha-256

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set it with the YB-TServer GFlag --ysql_pg_conf_csv="password_encryption=scram-sha-256" on every YB-TServer, restart it and reset existing passwords so they are re-hashed with SCRAM.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: yugabytedbauthentication
Referencia: CIS YugabyteDB Benchmark v2.0.0 - 5.9 Ensure password_encryption is set to scram-sha-256

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target yugabytedb