Restrict Access Using Host-Based Authentication

ВисокаНиво 1Ручни прегледcockroachdb

Опис

CockroachDB uses a host-based authentication (HBA) configuration to control which SQL connection attempts are allowed to proceed and which authentication methods they may use, based on the originating IP address and the SQL user. HBA rules are expressed in a PostgreSQL-compatible DSL and stored in the server.host_based_authentication.configuration cluster setting;

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; Rules must list only approved IP addresses/CIDRs for each user and end with a rule that rejects everything else (e.g. host all all all reject). An empty value (the default, equivalent to host all all all cert-password) or broad 0.0.0.0/0 rules is a finding.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

1. Define explicit whitelisted origins Construct an HBA configuration that lists only authorized IP ranges or hosts. For example: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all jump_user 203.0.113.10/32 password host all app_user 198.51.100.0/24 password host all all all reject ';

Својства

Оперативни системи: Било који
Ознаке: cockroachdbauthenticationnetwork
Референца: CIS CockroachDB v25.x Benchmark v1.0.0 - 4.1 Restrict Access Using Host-Based Authentication