TMA-OCEANBASE-3.2.3

Limit Accepted TLS Versions

높음레벨 2자동oceanbase

설명

OceanBase supports communication encryption to ensure that traffic between nodes cannot be eavesdropped or tampered with. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when sql_protocol_min_tls_version is TLSv1.2 or TLSv1.3 on all OBServer nodes (none, any, TLSv1 or TLSv1.1 fail). Mismatched values across nodes fail because each row is checked.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN COUNT(*) > 0 AND SUM(CASE WHEN value IN ('TLSv1.2', 'TLSv1.3') THEN 0 ELSE 1 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name = 'sql_protocol_min_tls_version'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

ALTER SYSTEM SET sql_protocol_min_tls_version = 'TLSv1.2'; (or 'TLSv1.3') and confirm the value on every OBServer with SHOW PARAMETERS LIKE 'sql_protocol_min_tls_version';

속성

운영 체제: 모두
태그: oceanbasetls
참고 자료: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.2.3 Limit Accepted TLS Versions

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oceanbase --level 2