Restrict and Secure Password Authentication

高等級 1人工審核cockroachdb

說明

CockroachDB self-hosted clusters support several authentication methods for SQL clients, including passwords, SCRAM-SHA-256, TLS client certificates, and others such as GSSAPI/Kerberos (Enterprise), JWT, LDAP/AD and OIDC.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run SHOW CLUSTER SETTING server.user_login.password_encryption; (must be scram-sha-256) and review SHOW USERS; plus SELECT username FROM system.users WHERE "hashedPassword" IS NOT NULL. Privileged and service accounts should use certificates; any remaining password hashes should be SCRAM-SHA-256 and passwords must meet length policy (server.user_login.min_password_length).

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Enable SCRAM-SHA-256 for new passwords Configure the cluster to use SCRAM-SHA-256 for all newly set passwords: SET CLUSTER SETTING server.user_login.password_encryption = 'scram-sha-256'; This ensures that any CREATE USER ... WITH PASSWORD or ALTER USER ... WITH PASSWORD operations store SCRAM-SHA-256 hashes. 2.

屬性

作業系統: 不限
標籤: cockroachdbauthentication
參考資料: CIS CockroachDB v25.x Benchmark v1.0.0 - 4.2 Restrict and Secure Password Authentication