Ensure No Users Have Wildcard Hostnames

VisokaNivo 2Automatskaoceanbase

Opis

All user accounts in the database should be strictly restricted to connect only from specific hosts or IP addresses explicitly required for their business operations. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when no account has host '%' (the defaults root@% and ORAAUDITOR@% fail until restricted).

Kako se proverava

Metod provere: SQL upit

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT COUNT(*) FROM mysql.user WHERE host = '%'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Očekivani izlaz: 0

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

RENAME USER '<user>'@'%' TO '<user>'@'<approved host or subnet>'; for every account returned.

Svojstva

Operativni sistemi: Bilo koji
Oznake: oceanbaseauthenticationnetwork
Referenca: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.1.7 Ensure No Users Have Wildcard Hostnames

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target oceanbase --level 2