Ensure Sensitive Configuration Data Is Encrypted

YüksekDüzey 1Manuel incelemetdsql

Açıklama

Sensitive data in configuration files (passwords, keys, connection strings) should be stored in encrypted form. TDSQL provides AES encryption and base64 encoding for credential protection.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

# Check for cleartext passwords in the configuration grep -rn 'password' /path/to/tdsql/conf/ | grep -v '#' | head -20 # Encrypted passwords appear as long base64-encoded strings. # Short, simple cleartext strings indicate unencrypted passwords.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Encrypt all passwords using TDSQL's encryption tools. Ensure the master key used for encryption is stored separately from the encrypted data and managed by an independent key management process. Integrating with a KMS is strongly recommended. Encryption process overview: 1.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: tdsqlcredentials
Referans: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 2.7 Ensure Sensitive Configuration Data Is Encrypted