Ensure there are no unnecessary roles or excessive privileges

보통레벨 2수동 검토yugabytedb

설명

Verify each role is required and has only the privileges needed to do its job.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

As a YCQL superuser run SELECT role, can_login, is_superuser, member_of FROM system_auth.roles; and SELECT * FROM system_auth.role_permissions; Any role that is not needed, or any role holding more permissions than its function requires, is a finding (DROP ROLE / REVOKE ... FROM ...).

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove any unnecessary roles and/or permissions in accordance with organizational needs. Drop unnecessary roles by issuing the following command: cassandra@ycqlsh> DROP ROLE IF EXISTS developer Alternatively, you can revoke permissions. For example, you can revoke the engineering role from the user john as follows: cassandra@ycqlsh> REVOKE engineering FROM john;

속성

운영 체제: 모두
태그: yugabytedbprivileges
참고 자료: CIS YugabyteDB Benchmark v2.0.0 - 5.4 Ensure there are no unnecessary roles or excessive privileges