Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account

高级别 1人工审核tdsql

说明

OC Tool is the TDSQL operations control tool used to perform management operations on target machines (such as installing components and launching instances). Its username should be a dedicated least-privilege account rather than root, and its password should be a strong random value stored encrypted.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Check the OC Tool configuration in scheduler.xml: <oc_tool ... user="..." password="..." .../> Confirm: 1. user is not root, but a dedicated least-privilege account (such as tdsql_oc). 2. The password field is encrypted (a long base64/ciphertext string) and differs from the install template's initial value. diff <(grep oc_tool /path/to/installed/conf/scheduler.xml) \ <(grep oc_tool /path/to/install_template/scheduler.xml)

修复方式

修复方法: 操作指南或基础设施补丁

1. Create a dedicated least-privilege operations account (non-root) on all TDSQL nodes. 2. Configure sudoers to grant only the necessary privileged commands. 3. Set a strong random password and store it encrypted. 4. Update the scheduler.xml configuration: <oc_tool ... user="tdsql_oc" password="<encrypted_strong_password>" .../>

属性

操作系统: 任意
标签: tdsqlcredentials
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.1 Ensure OC Tool Credentials Are Changed and Use a Least-Privilege Account