Do Not Grant Sudo Privileges to the CockroachDB Process User

高等級 1自動化cockroachdb

說明

CockroachDB should run under a dedicated, non-root operating system account that has only the permissions required to read and write CockroachDB's data, log, and certificate directories. This dedicated service user (commonly cockroach) must not be granted sudo privileges or be included in any privileged system groups (such as wheel, sudo, or adm). The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when every cockroach start process runs as a non-root user that is not in the sudo, wheel, admin or root groups. Also review /etc/sudoers and /etc/sudoers.d for entries naming the cockroach user.

檢查方式

稽核方法: Shell 指令

shell

out=$(ps -eo user=,args= | grep '[c]ockroach start') || exit 1; bad=0; for u in $(printf '%s\n' "$out" | awk '{print $1}' | sort -u); do [ "$u" = root ] && bad=1; if id -nG "$u" 2>/dev/null | tr ' ' '\n' | grep -qxE 'sudo|wheel|admin|root'; then bad=1; fi; done; [ $bad -eq 0 ] && echo compliant || echo privileged

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Run CockroachDB as a dedicated non-privileged 'cockroach' user (User=cockroach in the unit), remove it from sudo/wheel groups (gpasswd -d cockroach wheel) and delete any sudoers entries for it.

屬性

作業系統: 不限
標籤: cockroachdbservice-account
參考資料: CIS CockroachDB v25.x Benchmark v1.0.0 - 2.3 Do Not Grant Sudo Privileges to the CockroachDB Process User

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cockroachdb