Ensure Unnecessary System Services Are Disabled on TDSQL Hosts

低级别 2人工审核tdsql

说明

TDSQL hosts should run only the necessary services. Unnecessary services increase the attack surface.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Run systemctl list-unit-files --type=service --state=enabled and ss -tlnp on every TDSQL host. Only TDSQL components (mysqld, oss_server, scheduler, zookeeper, gateway/proxy, agents) and required OS services may be enabled or listening; services such as cups, avahi-daemon, bluetooth or telnet are a finding.

修复方式

修复方法: 操作指南或基础设施补丁

# Disable unnecessary services systemctl disable --now cups avahi-daemon bluetooth telnet.socket

属性

操作系统: 任意
标签: tdsqlos
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.8 Ensure Unnecessary System Services Are Disabled on TDSQL Hosts