TMA-TDSQL-5.12
Ensure the Callable Scope of OSS Sensitive Interfaces Is Restricted
Опис
OSS provides two layers of interface-level access control: interface_mask (sensitive interface allowlist) and deny_interfacename (interface denylist): interface_mask (oss.json:240-246) - lists interfaces that only authenticated privileged callers may invoke (such as TDSQL.AddUser, TDSQL.ResetPwd, TDSQL.GetKmsConfig, TDSQL.CreateKmsConfig).
Како се проверава
Метод провере: Ручни преглед
Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.
Run grep -A2 interface_mask <tdsql>/conf/oss.json and grep "<deny_interfacename" <tdsql>/conf/scheduler.xml. The mask must include TDSQL.AddUser, AddMultiUser, ModifyOssUser, ResetPwd, RegisterOssUser, ListUser, GetKmsConfig, CreateKmsConfig, ReplaceIp, ForceSwitchInstance, ForceSwitchMaster and ForceDelInstance; any missing interface is a finding.
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Extend the sensitive interface list in oss.json: { "name": "interface_mask", "value": "TDSQL.AddUser,TDSQL.ListUser,TDSQL.AddMultiUser,TDSQL.RegisterOssUser,TDSQL.Modif yOssUser,TDSQL.ResetPwd,TDSQL.GetKmsConfig,TDSQL.CreateKmsConfig,TDSQL.ReplaceIp,T DSQL.ForceSwitchInstance,TDSQL.DeleteInstance" } Add denylist interfaces in scheduler.xml (callable by no one): <deny_interfacename name="TDSQL.ReplaceIp"/> <deny_interfacename ...
Својства
- Оперативни системи
- Било који
- Ознаке
- tdsqloss
- Референца
- CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.12 Ensure the Callable Scope of OSS Sensitive Interfaces Is Restricted