TMA-TDSQL-11.1

Ensure ZooKeeper ACLs Are Enabled

VisokaNivo 1Automatskatdsql

Opis

TDSQL uses ZooKeeper to store cluster metadata, configuration information, and to coordinate node state. ZooKeeper ACLs (Access Control Lists) control access to ZNodes. Uses TDSQL_HOME (install directory with bin/, conf/, boot/, log/; default /data/tdsql); reads <TDSQL_HOME>/conf/scheduler.xml and passes when <zookeeper> has safeacl="1". Also confirm with zkCli.sh getAcl /tdsql that the ACL is not world:anyone:cdrwa.

Kako se proverava

Metod provere: Komanda ljuske

shell

f="${TDSQL_HOME:-/data/tdsql}/conf/scheduler.xml"; [ -r "$f" ] || exit 1; if grep -Eo '<zookeeper[^>]*' "$f" | grep -Eq '[[:space:]]safeacl="1"'; then echo compliant; else echo noncompliant; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set safeacl="1" on the <zookeeper> element of scheduler.xml, configure digest ACLs with a strong random credential and restart the affected components.

Svojstva

Operativni sistemi: Bilo koji
Oznake: tdsqlzookeeper
Referenca: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.1 Ensure ZooKeeper ACLs Are Enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target tdsql