TMA-COCKROACHDB-6.3
Ensure remote connections via TCP/IP sockets are configured correctly
설명
TCP/IP connections enable remote access to CockroachDB clusters across networks. CockroachDB supports multiple authentication methods for remote connections, with certificate-based authentication being the most secure option. All TCP/IP connections must use TLS encryption to protect data in transit. Remote connection security depends on proper network configuration, authentication method selection, and TLS settings.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
From a remote host run cockroach sql --insecure --host=<server>:26257 (must fail: server is not running in insecure mode) and cockroach sql --certs-dir=certs --host=<server>:26257 (must succeed). Check --listen-addr/--advertise-addr/--http-addr bind only intended interfaces and that clients use sslmode=verify-full.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Prerequisites: Complete certificate infrastructure setup as described in section 6.0. 1. Configure Server for Remote Access # Start CockroachDB listening on appropriate network interfaces cockroach start \ --certs-dir=certs \ --store=node1 \ --listen-addr=0.0.0.0:26257 \ --advertise-addr=database-server:26257 \ --http-addr=0.0.0.0:8080 \ --join=database-server:26257 # For multi-node clusters, configure each node cockroach start \ ...
속성
- 운영 체제
- 모두
- 태그
- cockroachdbtlsnetwork
- 참고 자료
- CIS CockroachDB v25.x Benchmark v1.0.0 - 6.3 Ensure remote connections via TCP/IP sockets are configured correctly