Ensure HBA configuration prohibits weak authentication methods

ВисокаНиво 1Ручни прегледyugabytedb

Опис

The ysql_hba_conf_csv GFlag controls the Host-Based Authentication (HBA) rules for YSQL connections. The authentication methods trust (no password required), md5 (MD5-hashed passwords), and password (cleartext passwords over the wire) are considered weak and should not be used in production environments.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Run SELECT line_number, type, database, user_name, address, auth_method FROM pg_hba_file_rules ORDER BY line_number; FAIL if any reachable row uses md5 or password, or trust (except type local for user yugabyte). The --ysql_hba_conf_csv list should use scram-sha-256/cert and end with a reject catch-all so auto-generated trailing rules are unreachable.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Update the --ysql_hba_conf_csv GFlag so that all reachable entries use strong authentication, and terminate the list with a reject catch-all to neutralize any auto- generated rules: ./bin/yb-tserver \ --ysql_hba_conf_csv='local all yugabyte trust,host all all 0.0.0.0/0 scram- sha-256,host all all ::0/0 scram-sha-256,host all all all reject' Adjust based on your network topology.

Својства

Оперативни системи: Било који
Ознаке: yugabytedbauthentication
Референца: CIS YugabyteDB Benchmark v2.0.0 - 5.8 Ensure HBA configuration prohibits weak authentication methods