TMA-OCEANBASE-3.2.3

Limit Accepted TLS Versions

YüksekDüzey 2Otomatikoceanbase

Açıklama

OceanBase supports communication encryption to ensure that traffic between nodes cannot be eavesdropped or tampered with. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when sql_protocol_min_tls_version is TLSv1.2 or TLSv1.3 on all OBServer nodes (none, any, TLSv1 or TLSv1.1 fail). Mismatched values across nodes fail because each row is checked.

Nasıl denetlenir

Denetim yöntemi: SQL sorgusu

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN COUNT(*) > 0 AND SUM(CASE WHEN value IN ('TLSv1.2', 'TLSv1.3') THEN 0 ELSE 1 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name = 'sql_protocol_min_tls_version'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

ALTER SYSTEM SET sql_protocol_min_tls_version = 'TLSv1.2'; (or 'TLSv1.3') and confirm the value on every OBServer with SHOW PARAMETERS LIKE 'sql_protocol_min_tls_version';

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: oceanbasetls
Referans: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.2.3 Limit Accepted TLS Versions

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target oceanbase --level 2