Ensure CockroachDB Cluster is Initialized Securely with TLS

嚴重等級 1人工審核cockroachdb

說明

CockroachDB clusters must be initialized and operated in secure mode so that all inter- node and client-node communication uses TLS with certificates signed by a trusted CA. CockroachDB's production documentation strongly recommends running secure clusters (with --certs-dir and valid certificates) instead of using --insecure, which disables all encryption and authentication.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run ps -ef | grep "[c]ockroach start": --insecure must not appear (--accept-sql-without-tls is also a weakness). Verify the certs directory (e.g. /var/lib/cockroach/certs) contains ca.crt, node.crt/node.key and client certificates, is owned by cockroach, and that the CA key is kept off the nodes. Confirm cockroach sql --insecure is rejected.

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Generate the cluster Certificate Authority (CA): The documentation suggests creating two directories on your local machine: certs (for public files) and my-safe-directory (for the private CA key). On a secure workstation: # Create directories for certificates # `certs` : You'll generate your CA certificate and all node and client certificates and keys in this directory.

屬性

作業系統: 不限
標籤: cockroachdbtlsauthentication
參考資料: CIS CockroachDB v25.x Benchmark v1.0.0 - 1.3 Ensure CockroachDB Cluster is Initialized Securely with TLS