Ensure ZooKeeper ACLs Are Enabled

TinggiLevel 1Otomatistdsql

Deskripsi

TDSQL uses ZooKeeper to store cluster metadata, configuration information, and to coordinate node state. ZooKeeper ACLs (Access Control Lists) control access to ZNodes. Uses TDSQL_HOME (install directory with bin/, conf/, boot/, log/; default /data/tdsql); reads <TDSQL_HOME>/conf/scheduler.xml and passes when <zookeeper> has safeacl="1". Also confirm with zkCli.sh getAcl /tdsql that the ACL is not world:anyone:cdrwa.

Cara pemeriksaan

Metode audit: Perintah shell

shell

f="${TDSQL_HOME:-/data/tdsql}/conf/scheduler.xml"; [ -r "$f" ] || exit 1; if grep -Eo '<zookeeper[^>]*' "$f" | grep -Eq '[[:space:]]safeacl="1"'; then echo compliant; else echo noncompliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set safeacl="1" on the <zookeeper> element of scheduler.xml, configure digest ACLs with a strong random credential and restart the affected components.

Properti

Sistem operasi: Apa saja
Tag: tdsqlzookeeper
Referensi: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.1 Ensure ZooKeeper ACLs Are Enabled

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target tdsql