TMA-COCKROACHDB-4.1
Restrict Access Using Host-Based Authentication
Deskripsi
CockroachDB uses a host-based authentication (HBA) configuration to control which SQL connection attempts are allowed to proceed and which authentication methods they may use, based on the originating IP address and the SQL user. HBA rules are expressed in a PostgreSQL-compatible DSL and stored in the server.host_based_authentication.configuration cluster setting;
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; Rules must list only approved IP addresses/CIDRs for each user and end with a rule that rejects everything else (e.g. host all all all reject). An empty value (the default, equivalent to host all all all cert-password) or broad 0.0.0.0/0 rules is a finding.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
1. Define explicit whitelisted origins Construct an HBA configuration that lists only authorized IP ranges or hosts. For example: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all jump_user 203.0.113.10/32 password host all app_user 198.51.100.0/24 password host all all all reject ';
Properti
- Sistem operasi
- Apa saja
- Tag
- cockroachdbauthenticationnetwork
- Referensi
- CIS CockroachDB v25.x Benchmark v1.0.0 - 4.1 Restrict Access Using Host-Based Authentication