TMA-OCEANBASE-3.3

Ensure Replication Traffic is Secured

CaoCấp 1Tự độngoceanbase

Mô tả

The replication traffic between servers in OceanBase cluster should be secured. Security measures should include ensuring the confidentiality and integrity of the traffic, and performing mutual authentication between the servers before performing replication. Runs obclient with the connection options in OB_CONN (default "-h127.0.0.1 -P2881 -uroot@sys"); point it at the MySQL-mode tenant being assessed and supply the password via OB_CONN (-p...) or a [client] section in ~/.my.cnf. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when ssl_client_authentication is True and rpc_server_authentication_method is SSL_NO_ENCRYPT on every OBServer; also confirm valid certificates are deployed on all observers.

Cách kiểm tra

Phương pháp kiểm tra: Truy vấn SQL

sql_query

out=$(obclient ${OB_CONN:--h127.0.0.1 -P2881 -uroot@sys} -N -B -e "SELECT CASE WHEN SUM(CASE WHEN name = 'ssl_client_authentication' AND UPPER(value) = 'TRUE' THEN 1 ELSE 0 END) > 0 AND SUM(CASE WHEN name = 'ssl_client_authentication' AND UPPER(value) <> 'TRUE' THEN 1 ELSE 0 END) = 0 AND SUM(CASE WHEN name = 'rpc_server_authentication_method' AND UPPER(value) = 'SSL_NO_ENCRYPT' THEN 1 ELSE 0 END) > 0 AND SUM(CASE WHEN name = 'rpc_server_authentication_method' AND UPPER(value) <> 'SSL_NO_ENCRYPT' THEN 1 ELSE 0 END) = 0 THEN 'compliant' ELSE 'noncompliant' END FROM oceanbase.GV\$OB_PARAMETERS WHERE name IN ('ssl_client_authentication', 'rpc_server_authentication_method')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Deploy CA/server certificates to every observer, then ALTER SYSTEM SET ssl_client_authentication = 'True'; ALTER SYSTEM SET rpc_server_authentication_method = 'SSL_NO_ENCRYPT'; and set sql_protocol_min_tls_version = 'TLSv1.2'.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: oceanbasetlsreplication
Tham chiếu: CIS OceanBase Enterprise Edition V4 Benchmark v1.0.0 - 3.3 Ensure Replication Traffic is Secured

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target oceanbase