Ensure ZooKeeper ACLs Are Enabled

高级别 1自动化tdsql

说明

TDSQL uses ZooKeeper to store cluster metadata, configuration information, and to coordinate node state. ZooKeeper ACLs (Access Control Lists) control access to ZNodes. Uses TDSQL_HOME (install directory with bin/, conf/, boot/, log/; default /data/tdsql); reads <TDSQL_HOME>/conf/scheduler.xml and passes when <zookeeper> has safeacl="1". Also confirm with zkCli.sh getAcl /tdsql that the ACL is not world:anyone:cdrwa.

检查方式

审计方法: Shell 命令

shell

f="${TDSQL_HOME:-/data/tdsql}/conf/scheduler.xml"; [ -r "$f" ] || exit 1; if grep -Eo '<zookeeper[^>]*' "$f" | grep -Eq '[[:space:]]safeacl="1"'; then echo compliant; else echo noncompliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Set safeacl="1" on the <zookeeper> element of scheduler.xml, configure digest ACLs with a strong random credential and restart the affected components.

属性

操作系统: 任意
标签: tdsqlzookeeper
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.1 Ensure ZooKeeper ACLs Are Enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target tdsql