Ensure Manager Database Credentials Are Encrypted

高等級 1人工審核tdsql

說明

The credential (tdsqlsys_kp_new) used by the TDSQL Manager to connect to MySQL instances should be stored encrypted.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Check the Manager DB configuration in scheduler.xml: <manager_db user="tdsqlsys_kp_new" password="..." /> Confirm the password field is encrypted (base64-encoded, length >= 24 bytes), not a short readable string. Also verify the value differs from the install template's initial value.

修補方式

修補方法: 操作指南或基礎設施修補檔

Encrypt the password using the TDSQL encryption tool: # Encrypt with the cluster master key (see section 2.6 for tool details) /path/to/tdsql/bin/crypt_tool -e "<cluster_master_key>" "<plain_password>" # Put the resulting ciphertext into the manager_db.password field of scheduler.xml

屬性

作業系統: 不限
標籤: tdsqlcredentials
參考資料: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.2 Ensure Manager Database Credentials Are Encrypted