Ensure CockroachDB Cluster is Initialized Securely with TLS

严重级别 1人工审核cockroachdb

说明

CockroachDB clusters must be initialized and operated in secure mode so that all inter- node and client-node communication uses TLS with certificates signed by a trusted CA. CockroachDB's production documentation strongly recommends running secure clusters (with --certs-dir and valid certificates) instead of using --insecure, which disables all encryption and authentication.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Run ps -ef | grep "[c]ockroach start": --insecure must not appear (--accept-sql-without-tls is also a weakness). Verify the certs directory (e.g. /var/lib/cockroach/certs) contains ca.crt, node.crt/node.key and client certificates, is owned by cockroach, and that the CA key is kept off the nodes. Confirm cockroach sql --insecure is rejected.

修复方式

修复方法: 操作指南或基础设施补丁

1. Generate the cluster Certificate Authority (CA): The documentation suggests creating two directories on your local machine: certs (for public files) and my-safe-directory (for the private CA key). On a secure workstation: # Create directories for certificates # `certs` : You'll generate your CA certificate and all node and client certificates and keys in this directory.

属性

操作系统: 任意
标签: cockroachdbtlsauthentication
参考: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.3 Ensure CockroachDB Cluster is Initialized Securely with TLS