Ensure System Account Privileges Are Minimized

中等級 1人工審核tdsql

說明

TDSQL includes several built-in system accounts for different purposes. Each account should hold only the minimum privileges necessary for its function.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Run SHOW GRANTS FOR 'tdsqlsys_check'@'%'; SHOW GRANTS FOR 'tdsqlsys_agent'@'%'; SHOW GRANTS FOR 'tdsqlsys_repl'@'%'; (and the other tdsqlsys_* accounts) and compare each with the minimum privileges required for its function per the benchmark table (e.g. tdsqlsys_repl only REPLICATION SLAVE, REPLICATION CLIENT). Any extra privilege is a finding.

修補方式

修補方法: 操作指南或基礎設施修補檔

Adjust system account privileges through the TDSQL Manager to ensure each account holds only the necessary privileges. Note: Modifying system account privileges may affect normal operation of TDSQL components; test thoroughly before making changes.

屬性

作業系統: 不限
標籤: tdsqlprivileges
參考資料: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 5.3 Ensure System Account Privileges Are Minimized