Ensure ZooKeeper Authentication Credentials Have Been Changed

嚴重等級 1人工審核tdsql

說明

TDSQL uses digest authentication to connect to ZooKeeper. The initial credentials used during installation should be uniformly changed to strong random values by the deployment side before production and stored encrypted.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

# 1. Attempt to access a key ZNode via zkCli as an unauthorized identity (should be denied) zkCli.sh -server <zk_ip>:<port> ls /tdsql # Expected: Authentication is not valid # 2. Compare the deployed ZK authentication credentials against the install template's initial values; they must differ # (The exact location depends on the deployment form: centralized deployment uses scheduler.xml; TCE deployment uses the tdsql_install template)

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Generate a new strong random password (>= 16 characters including uppercase, lowercase, digits, and special characters). 2. Batch-update the ZK authentication configuration of all TDSQL components (OSS, Manager, Scheduler, Keeper, Agent, Proxy) via the deployment tool. 3. Re-setAcl existing ZNodes to apply the new credentials. 4. Enable ACL mode (see Recommendation 10.1). Note: This operation requires updating all components simultaneously;

屬性

作業系統: 不限
標籤: tdsqlzookeepercredentials
參考資料: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 11.2 Ensure ZooKeeper Authentication Credentials Have Been Changed