Ensure No Excessive `SUPER` Privilege Grants

高级别 1人工审核tdsql

说明

The SUPER privilege allows many dangerous operations, including modifying global variables, killing other users' queries, and bypassing read-only restrictions.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

SELECT User, Host FROM mysql.user WHERE Super_priv = 'Y'; Confirm only TDSQL system accounts (such as the necessary tdsqlsys_kp_new) hold the SUPER privilege.

修复方式

修复方法: 操作指南或基础设施补丁

Revoke the SUPER privilege from unnecessary users: REVOKE SUPER ON *.* FROM 'username'@'host'; In MySQL 8.0, use fine-grained dynamic privileges (such as SYSTEM_VARIABLES_ADMIN, CONNECTION_ADMIN) instead of SUPER.

属性

操作系统: 任意
标签: tdsqlprivileges
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.5 Ensure No Excessive `SUPER` Privilege Grants