TMA-COCKROACHDB-3.3

Ensure Connection Authentication Logging Is Enabled

高レベル 1自動cockroachdb

説明

CockroachDB can log client connection attempts, successful logins, authentication failures, and session disconnections through the SESSIONS logging channel. By default, this channel's logging is disabled to minimize overhead on all clusters. Runs cockroach sql with --certs-dir ${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs} (a root or admin client certificate must be in it); the target node comes from COCKROACH_HOST (default localhost:26257) or COCKROACH_URL. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when server.auth_log.sql_connections.enabled and server.auth_log.sql_sessions.enabled are both true.

チェック方法

監査方法: SQL クエリ

sql_query

out=$(cockroach sql --certs-dir="${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs}" --format=csv --execute "SHOW CLUSTER SETTING server.auth_log.sql_connections.enabled; SHOW CLUSTER SETTING server.auth_log.sql_sessions.enabled;" 2>/dev/null) || exit 1; printf '%s\n' "$out" | grep -cx true || true

期待される出力: 2

修正方法

修正方法: ガイダンスまたは IaC パッチ

SET CLUSTER SETTING server.auth_log.sql_connections.enabled = true; SET CLUSTER SETTING server.auth_log.sql_sessions.enabled = true; and keep the SESSIONS channel routed to cockroach-sql-auth.log.

プロパティ

オペレーティングシステム: すべて
タグ: cockroachdbloggingauthentication
参照: CIS CockroachDB v25.x Benchmark v1.0.0 - 3.3 Ensure Connection Authentication Logging Is Enabled

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target cockroachdb