TMA-YUGABYTEDB-5.8
Ensure HBA configuration prohibits weak authentication methods
설명
The ysql_hba_conf_csv GFlag controls the Host-Based Authentication (HBA) rules for YSQL connections. The authentication methods trust (no password required), md5 (MD5-hashed passwords), and password (cleartext passwords over the wire) are considered weak and should not be used in production environments.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Run SELECT line_number, type, database, user_name, address, auth_method FROM pg_hba_file_rules ORDER BY line_number; FAIL if any reachable row uses md5 or password, or trust (except type local for user yugabyte). The --ysql_hba_conf_csv list should use scram-sha-256/cert and end with a reject catch-all so auto-generated trailing rules are unreachable.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Update the --ysql_hba_conf_csv GFlag so that all reachable entries use strong authentication, and terminate the list with a reject catch-all to neutralize any auto- generated rules: ./bin/yb-tserver \ --ysql_hba_conf_csv='local all yugabyte trust,host all all 0.0.0.0/0 scram- sha-256,host all all ::0/0 scram-sha-256,host all all all reject' Adjust based on your network topology.
속성
- 운영 체제
- 모두
- 태그
- yugabytedbauthentication
- 참고 자료
- CIS YugabyteDB Benchmark v2.0.0 - 5.8 Ensure HBA configuration prohibits weak authentication methods