10.2 Allowlist Approved Servers Belonging to a MySQL InnoDB Cluster

Information

Optionally, specify an allowlist of approved servers that belong to the MySQL InnoDB Cluster.

Rationale:

When using MySQL InnoDB Cluster by specifying the allowlist explicitly, you can increase the security of your cluster as only servers in the allowlist are allowed to connect to the cluster.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Example - to configure a cluster to only accept connections from servers at addresses 203.0.113.0/24 and 198.51.100.110. The whitelist can also include host names, which are resolved only when a connection request is made by another server.

From 8.0.22:

mysql-js> cluster.addInstance('icadmin@ic-3:3306', {ipAllowlist: '203.0.113.0/24, 198.51.100.110'})

Prior to 8.0.22:

mysql-js> cluster.addInstance('icadmin@ic-3:3306', {ipWhitelist: '203.0.113.0/24, 198.51.100.110'})

See Also

https://workbench.cisecurity.org/benchmarks/10139

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2

Plugin: MySQLDB

Control ID: 8a94ed94e65169daa570b2d6ce919596e5d9d50ecaff71f0618e5b95153f02f4