Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

高等級 1自動化tdsql

說明

The MYSQL_PWD environment variable stores the MySQL password in cleartext. Any environment variable used to pass runtime passwords or encryption keys should not persist in the process environment on production nodes. Counts running processes whose environment contains MYSQL_PWD plus system and user shell profiles that set it (run as root to read every /proc/<pid>/environ). Also review environments for other *_KEY / *_SECRET / *_PASSWORD variables.

檢查方式

稽核方法: Shell 指令

shell

c=$( { grep -l MYSQL_PWD /proc/[0-9]*/environ 2>/dev/null; grep -ls MYSQL_PWD /etc/profile /etc/bashrc /etc/bash.bashrc /etc/environment /etc/profile.d/* /root/.bashrc /root/.bash_profile /root/.profile /home/*/.bashrc /home/*/.bash_profile /home/*/.profile 2>/dev/null; } | wc -l); echo $c

預期輸出: 0

修補方式

修補方法: 操作指南或基礎設施修補檔

Remove MYSQL_PWD from /etc/profile, /etc/bashrc and user profiles, unset it in running service environments, use ~/.my.cnf (mode 600) or mysql_config_editor login paths, and delete temporary key scripts left from installation.

屬性

作業系統: 不限
標籤: tdsqlcredentials
參考資料: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.4 Ensure MYSQL_PWD and Sensitive Environment Variables Are Not Used

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target tdsql