Ensure Correct Permissions on Audit Log Files

VisokaNivo 2Automatskatdsql

Opis

If MySQL audit logging is enabled, the audit log files must have restrictive permissions. Audit logs are critical for security monitoring and forensic analysis. Searches /data/tdsql (the benchmark path; confirm audit_txsql_audit_dir points inside it). Counts audit files accessible by other users; expected 0600 or 0640, owner mysql:mysql.

Kako se proverava

Metod provere: Komanda ljuske

shell

n=0; for p in "/data/tdsql"; do [ -e "$p" ] && n=$((n+1)); done; [ $n -gt 0 ] || exit 1; c=0; for p in "/data/tdsql"; do [ -e "$p" ] || continue; c=$((c + $(find "$p" -type f -name '*audit*' -perm /o+rw -print 2>/dev/null | wc -l))); done; echo $c

Očekivani izlaz: 0

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

find /data/tdsql -name '*audit*' -type f -exec chmod 640 {} +; chown mysql:mysql those files.

Svojstva

Operativni sistemi: Bilo koji
Oznake: tdsqlpermissionsaudit
Referenca: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 3.12 Ensure Correct Permissions on Audit Log Files

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target tdsql --level 2