Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account

ВисокаНиво 1Ручни прегледtdsql

Опис

OC Tool is the TDSQL operations control tool used to perform management operations on target machines (such as installing components and launching instances). Its username should be a dedicated least-privilege account rather than root, and its password should be a strong random value stored encrypted.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>

Својства

Оперативни системи: Било који
Ознаке: tdsqlcredentials
Референца: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.1 Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account