Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>