Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

高级别 1自动化tdsql

说明

The MYSQL_PWD environment variable stores the MySQL password in cleartext. Any environment variable used to pass runtime passwords or encryption keys should not persist in the process environment on production nodes. Counts running processes whose environment contains MYSQL_PWD plus system and user shell profiles that set it (run as root to read every /proc/<pid>/environ). Also review environments for other *_KEY / *_SECRET / *_PASSWORD variables.

检查方式

审计方法: Shell 命令

shell

c=$( { grep -l MYSQL_PWD /proc/[0-9]*/environ 2>/dev/null; grep -ls MYSQL_PWD /etc/profile /etc/bashrc /etc/bash.bashrc /etc/environment /etc/profile.d/* /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /home/*/.profile 2>/dev/null; } | wc -l); echo $c

预期输出: 0

修复方式

修复方法: 操作指南或基础设施补丁

Remove MYSQL_PWD from /etc/profile, /etc/bashrc and user profiles, unset it in running service environments, use ~/.my.cnf (mode 600) or mysql_config_editor login paths, and delete temporary key scripts left from installation.

属性

操作系统: 任意
标签: tdsqlcredentials
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.4 Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target tdsql