TMA-TDSQL-12.1
Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account
Deskripsi
OC Tool is the TDSQL operations control tool used to perform management operations on target machines (such as installing components and launching instances). Its username should be a dedicated least-privilege account rather than root, and its password should be a strong random value stored encrypted.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>
Properti
- Sistem operasi
- Apa saja
- Tag
- tdsqlcredentials
- Referensi
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.1 Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account