TMA-COCKROACHDB-4.3
Secure the root User and Administrative Roles
Mô tả
The root user in CockroachDB has unrestricted administrative privileges across the entire cluster. Because compromise of root grants full control, its use must be tightly restricted and secured. The root account should authenticate exclusively with TLS client certificates (mTLS), and password authentication must be disabled.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Run SHOW CLUSTER SETTING server.host_based_authentication.configuration; rules for root must use cert (cert-*) methods only and be limited to jump-host CIDRs, followed by host all root all reject. Run SHOW ROLES and SHOW GRANTS ON ROLE admin: membership of admin must be limited to approved administrators, and applications must not connect as root.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
1. Enforce certificate-only authentication for root Update the HBA configuration to allow only certificate-based methods: SET CLUSTER SETTING server.host_based_authentication.configuration = ' TYPE DATABASE USER ADDRESS METHOD host all root <jumpbox-cidr> cert host all root all reject '; Replace <jumpbox-cidr> with your actual admin network. 2. Restrict root usage operationally - Replace script usage with least-privilege service accounts.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- cockroachdbauthenticationprivileges
- Tham chiếu
- CIS CockroachDB v25.x Benchmark v1.0.0 - 4.3 Secure the root User and Administrative Roles