Ensure CockroachDB Cluster is Initialized Securely with TLS

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Run ps -ef | grep "[c]ockroach start": --insecure must not appear (--accept-sql-without-tls is also a weakness). Verify the certs directory (e.g. /var/lib/cockroach/certs) contains ca.crt, node.crt/node.key and client certificates, is owned by cockroach, and that the CA key is kept off the nodes. Confirm cockroach sql --insecure is rejected.

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Generate the cluster Certificate Authority (CA): The documentation suggests creating two directories on your local machine: certs (for public files) and my-safe-directory (for the private CA key). On a secure workstation: # Create directories for certificates # `certs` : You'll generate your CA certificate and all node and client certificates and keys in this directory.