Ensure Replication Traffic is Secured

ÉlevéeNiveau 1Automatiséeoceanbase

Description

The replication traffic between servers in OceanBase cluster should be secured. Security measures should include ensuring the confidentiality and integrity of the traffic, and performing mutual authentication between the servers before performing replication. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when ssl_client_authentication is True and rpc_server_authentication_method is SSL_NO_ENCRYPT on every OBServer; also confirm valid certificates are deployed on all observers.

Méthode de vérification

Méthode d'audit: Requête SQL

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN SUM(CASE WHEN name = 'ssl_client_authentication' AND UPPER(value) = 'TRUE' THEN 1 ELSE 0 END) > 0 AND SUM(CASE WHEN name = 'ssl_client_authentication' AND UPPER(value) <> 'TRUE' THEN 1 ELSE 0 END) = 0 AND SUM(CASE WHEN name = 'rpc_server_authentication_method' AND UPPER(value) = 'SSL_NO_ENCRYPT' THEN 1 ELSE 0 END) > 0 AND SUM(CASE WHEN name = 'rpc_server_authentication_method' AND UPPER(value) <> 'SSL_NO_ENCRYPT' THEN 1 ELSE 0 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name IN ('ssl_client_authentication', 'rpc_server_authentication_method')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Deploy CA/server certificates to every observer, then ALTER SYSTEM SET ssl_client_authentication = 'True'; ALTER SYSTEM SET rpc_server_authentication_method = 'SSL_NO_ENCRYPT'; and set sql_protocol_min_tls_version = 'TLSv1.2'.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: oceanbasetlsreplication
Référence: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.3 Ensure Replication Traffic is Secured

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target oceanbase