Ensure ZooKeeper Authentication Credentials Have Been Changed

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

# 1. Attempt to access a key ZNode via zkCli as an unauthorized identity (should be denied) zkCli.sh -server <zk_ip>:<port> ls /tdsql # Expected: Authentication is not valid # 2. Compare the deployed ZK authentication credentials against the install template's initial values; they must differ # (The exact location depends on the deployment form: centralized deployment uses scheduler.xml; TCE deployment uses the tdsql_install template)

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Generate a new strong random password (>= 16 characters including uppercase, lowercase, digits, and special characters). 2. Batch-update the ZK authentication configuration of all TDSQL components (OSS, Manager, Scheduler, Keeper, Agent, Proxy) via the deployment tool. 3. Re-setAcl existing ZNodes to apply the new credentials. 4. Enable ACL mode (see Recommendation 10.1). Note: This operation requires updating all components simultaneously;