TMA-COCKROACHDB-2.3

Do Not Grant Sudo Privileges to the CockroachDB Process User

높음레벨 1자동cockroachdb

설명

CockroachDB should run under a dedicated, non-root operating system account that has only the permissions required to read and write CockroachDB's data, log, and certificate directories. This dedicated service user (commonly cockroach) must not be granted sudo privileges or be included in any privileged system groups (such as wheel, sudo, or adm). The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when every cockroach start process runs as a non-root user that is not in the sudo, wheel, admin or root groups. Also review /etc/sudoers and /etc/sudoers.d for entries naming the cockroach user.

점검 방법

감사 방식: 셸 명령

shell

out=$(ps -eo user=,args= | grep '[c]ockroach start') || exit 1; bad=0; for u in $(printf '%s\n' "$out" | awk '{print $1}' | sort -u); do [ "$u" = root ] && bad=1; if id -nG "$u" 2>/dev/null | tr ' ' '\n' | grep -qxE 'sudo|wheel|admin|root'; then bad=1; fi; done; [ $bad -eq 0 ] && echo compliant || echo privileged

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run CockroachDB as a dedicated non-privileged 'cockroach' user (User=cockroach in the unit), remove it from sudo/wheel groups (gpasswd -d cockroach wheel) and delete any sudoers entries for it.

속성

운영 체제: 모두
태그: cockroachdbservice-account
참고 자료: CIS CockroachDB v25.x Benchmark v1.0.0 - 2.3 Do Not Grant Sudo Privileges to the CockroachDB Process User

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cockroachdb