Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account

VisokaNivo 1Ručni pregledtdsql

Opis

OC Tool is the TDSQL operations control tool used to perform management operations on target machines (such as installing components and launching instances). Its username should be a dedicated least-privilege account rather than root, and its password should be a strong random value stored encrypted.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>

Svojstva

Operativni sistemi: Bilo koji
Oznake: tdsqlcredentials
Referenca: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.1 Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account