Restrict Access Using Host-Based Authentication

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; Rules must list only approved IP addresses/CIDRs for each user and end with a rule that rejects everything else (e.g. host all all all reject). An empty value (the default, equivalent to host all all all cert-password) or broad 0.0.0.0/0 rules is a finding.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. Define explicit whitelisted origins Construct an HBA configuration that lists only authorized IP ranges or hosts. For example: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all jump_user 203.0.113.10/32 password host all app_user 198.51.100.0/24 password host all all all reject ';