Ensure ZooKeeper Authentication Credentials Have Been Changed

KritikDüzey 1Manuel incelemetdsql

Açıklama

TDSQL uses digest authentication to connect to ZooKeeper. The initial credentials used during installation should be uniformly changed to strong random values by the deployment side before production and stored encrypted.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

# 1. Attempt to access a key ZNode via zkCli as an unauthorized identity (should be denied) zkCli.sh -server <zk_ip>:<port> ls /tdsql # Expected: Authentication is not valid # 2. Compare the deployed ZK authentication credentials against the install template's initial values; they must differ # (The exact location depends on the deployment form: centralized deployment uses scheduler.xml; TCE deployment uses the tdsql_install template)

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. Generate a new strong random password (>= 16 characters including uppercase, lowercase, digits, and special characters). 2. Batch-update the ZK authentication configuration of all TDSQL components (OSS, Manager, Scheduler, Keeper, Agent, Proxy) via the deployment tool. 3. Re-setAcl existing ZNodes to apply the new credentials. 4. Enable ACL mode (see Recommendation 10.1). Note: This operation requires updating all components simultaneously;

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: tdsqlzookeepercredentials
Referans: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.2 Ensure ZooKeeper Authentication Credentials Have Been Changed