Do Not Reuse Usernames

SedangLevel 2Tinjauan manualoceanbase

Deskripsi

Each database user account should be assigned a unique purpose (e.g., dedicated to a specific individual or application) and should not be shared among multiple different applications or users.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

This recommendation requires a manual review to map database accounts to real-world owners (applications or individuals) and to confirm that accounts are not shared. 1. Obtain a list of non-reserved (non-system) users: SELECT User, Host FROM mysql.user WHERE User NOT IN ('root','ORAAUDITOR','proxyro'); 2.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

1. List text hereCreate dedicated accounts for each application/user: CREATE USER 'app1_user'@'10.%' IDENTIFIED BY 'Strong_Password_Here'; CREATE USER 'app2_user'@'10.%' IDENTIFIED BY 'Strong_Password_Here'; 2. List text hereGrant only the required privileges (examples; adjust to your schema and least-privilege requirements): GRANT SELECT, INSERT, UPDATE, DELETE ON app1_db.* TO 'app1_user'@'10.%'; GRANT SELECT ON app2_db.* TO 'app2_user'@'10.%';

Properti

Sistem operasi: Apa saja
Tag: oceanbaseauthentication
Referensi: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.1.4 Do Not Reuse Usernames