Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account

AltaNível 1Revisão manualtdsql

Descrição

OC Tool is the TDSQL operations control tool used to perform management operations on target machines (such as installing components and launching instances). Its username should be a dedicated least-privilege account rather than root, and its password should be a strong random value stored encrypted.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>

Propriedades

Sistemas operacionais: Qualquer
Tags: tdsqlcredentials
Referência: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.1 Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account