TMA-TDSQL-1.4

Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

높음레벨 1자동tdsql

설명

The MYSQL_PWD environment variable stores the MySQL password in cleartext. Any environment variable used to pass runtime passwords or encryption keys should not persist in the process environment on production nodes. Counts running processes whose environment contains MYSQL_PWD plus system and user shell profiles that set it (run as root to read every /proc/<pid>/environ). Also review environments for other *_KEY / *_SECRET / *_PASSWORD variables.

점검 방법

감사 방식: 셸 명령

shell

c=$( { grep -l MYSQL_PWD /proc/[0-9]*/environ 2>/dev/null; grep -ls MYSQL_PWD /etc/profile /etc/bashrc /etc/bash.bashrc /etc/environment /etc/profile.d/* /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /home/*/.profile 2>/dev/null; } | wc -l); echo $c

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove MYSQL_PWD from /etc/profile, /etc/bashrc and user profiles, unset it in running service environments, use ~/.my.cnf (mode 600) or mysql_config_editor login paths, and delete temporary key scripts left from installation.

속성

운영 체제: 모두
태그: tdsqlcredentials
참고 자료: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.4 Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target tdsql