Ensure No Users Have Wildcard Hostnames

YüksekDüzey 2Otomatikoceanbase

Açıklama

All user accounts in the database should be strictly restricted to connect only from specific hosts or IP addresses explicitly required for their business operations. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. Passes when no account has host '%' (the defaults root@% and ORAAUDITOR@% fail until restricted).

Nasıl denetlenir

Denetim yöntemi: SQL sorgusu

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT COUNT(*) FROM mysql.user WHERE host = '%'" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Beklenen çıktı: 0

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

RENAME USER '<user>'@'%' TO '<user>'@'<approved host or subnet>'; for every account returned.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: oceanbaseauthenticationnetwork
Referans: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 4.1.7 Ensure No Users Have Wildcard Hostnames

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target oceanbase --level 2