Restrict Access Using Host-Based Authentication

AltaNível 1Revisão manualcockroachdb

Descrição

CockroachDB uses a host-based authentication (HBA) configuration to control which SQL connection attempts are allowed to proceed and which authentication methods they may use, based on the originating IP address and the SQL user. HBA rules are expressed in a PostgreSQL-compatible DSL and stored in the server.host_based_authentication.configuration cluster setting;

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; Rules must list only approved IP addresses/CIDRs for each user and end with a rule that rejects everything else (e.g. host all all all reject). An empty value (the default, equivalent to host all all all cert-password) or broad 0.0.0.0/0 rules is a finding.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

1. Define explicit whitelisted origins Construct an HBA configuration that lists only authorized IP ranges or hosts. For example: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all jump_user 203.0.113.10/32 password host all app_user 198.51.100.0/24 password host all all all reject ';

Propriedades

Sistemas operacionais: Qualquer
Tags: cockroachdbauthenticationnetwork
Referência: CIS CockroachDB v25.x Benchmark v1.0.0 - 4.1 Restrict Access Using Host-Based Authentication