Ensure CockroachDB Cluster is Initialized Securely with TLS

KritisLevel 1Tinjauan manualcockroachdb

Deskripsi

CockroachDB clusters must be initialized and operated in secure mode so that all inter- node and client-node communication uses TLS with certificates signed by a trusted CA. CockroachDB's production documentation strongly recommends running secure clusters (with --certs-dir and valid certificates) instead of using --insecure, which disables all encryption and authentication.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Run ps -ef | grep "[c]ockroach start": --insecure must not appear (--accept-sql-without-tls is also a weakness). Verify the certs directory (e.g. /var/lib/cockroach/certs) contains ca.crt, node.crt/node.key and client certificates, is owned by cockroach, and that the CA key is kept off the nodes. Confirm cockroach sql --insecure is rejected.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

1. Generate the cluster Certificate Authority (CA): The documentation suggests creating two directories on your local machine: certs (for public files) and my-safe-directory (for the private CA key). On a secure workstation: # Create directories for certificates # `certs` : You'll generate your CA certificate and all node and client certificates and keys in this directory.

Properti

Sistem operasi: Apa saja
Tag: cockroachdbtlsauthentication
Referensi: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.3 Ensure CockroachDB Cluster is Initialized Securely with TLS