Ensure No Users Have Wildcard Hostnames

높음레벨 2자동oceanbase

설명

All user accounts in the database should be strictly restricted to connect only from specific hosts or IP addresses explicitly required for their business operations. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when no account has host '%' (the defaults root@% and ORAAUDITOR@% fail until restricted).

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT COUNT(*) FROM mysql.user WHERE host = '%'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

RENAME USER '<user>'@'%' TO '<user>'@'<approved host or subnet>'; for every account returned.

속성

운영 체제: 모두
태그: oceanbaseauthenticationnetwork
참고 자료: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.1.7 Ensure No Users Have Wildcard Hostnames

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oceanbase --level 2