Auditing CIS Benchmark Compliance

Assesses a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 profile. Evaluates 30 controls across six domains: installation and patches, system hardening and topology, logging and monitoring, user access and authorization, data protection, and CockroachDB settings. Produces a structured report with PASS, FAIL, and MANUAL REVIEW findings, including CIS Controls v7/v8 mappings with Implementation Group coverage.

Scope: Self-hosted CockroachDB deployments only. For CockroachDB Cloud clusters, use auditing-cloud-cluster-security instead — Cloud clusters have managed controls that supersede many CIS self-hosted checks.

Authoritative source: This skill implements the benchmark defined at https://github.com/cockroachlabs/CIS-benchmarks-crdb

Read-only audit: All operations are read-only. No cluster state, OS configuration, or files are modified during the assessment.

When to Use This Skill

• Preparing for a CIS benchmark compliance assessment or external audit
• Hardening a new self-hosted CockroachDB production deployment
• Validating security posture against industry-standard benchmarks
• Performing periodic compliance checks as part of security operations
• Mapping CockroachDB security controls to CIS Controls frameworks
• Responding to auditor requests for CIS benchmark evidence

Prerequisites

Access requirements:

Tools:

Audit Depth

This skill supports two audit depths. Choose based on your needs:

At Step 0, confirm which depth the user wants. Both depths can be combined — run the quick scan first to identify failures, then run the full audit on those failures for evidence collection.

CIS Benchmark Structure

The CIS CockroachDB Benchmark v1.0.0 Level 1 profile contains 30 controls organized into six sections:

See CIS controls reference for full control definitions with both quick scan commands and full audit procedures.

Assessment Workflow

Step 0: Confirm Audit Scope

Before starting, confirm with the user:

1. Audit depth — Quick scan, full audit, or both
2. Target nodes — Which nodes to audit (all nodes recommended)
3. CockroachDB service account — Username running CockroachDB (default: cockroach)
4. Certificate directory — Path to TLS certificates (default: /var/lib/cockroach/certs)
5. Data directory — Path to CockroachDB data store (default: /var/lib/cockroach)
6. Log directory — Path to logs (default: /var/lib/cockroach/logs or <store>/logs)
7. Enterprise license — Whether Enterprise features (EAR) are available

Record these values — they parameterize the checks below.

Step 1: Installation and Patches (Controls 1.1–1.7)

These controls verify binary integrity, systemd service management, TLS initialization, version uniformity, upgrade processes, and encryption at rest.

Key checks:

• 1.1: Binary downloaded from official source, SHA-256 verified (Manual)
• 1.2: systemctl is-enabled cockroach.service → enabled (Automated)
• 1.3: No --insecure flag; certs directory exists with valid CA-signed certs (Automated)
• 1.4: ps aux | grep -c insecure → 0 (Automated)
• 1.5: All nodes run same version — quick scan via cockroach version, full audit via DB Console Node List and crdb_internal.gossip_nodes (Automated)
• 1.6: Rolling upgrade runbook exists and has been tested (Manual)
• 1.7: --enterprise-encryption configured with external KMS, keys not on disk (Manual)

Step 2: System Hardening and Topology (Controls 2.1–2.7)

These controls verify OS-level configuration: time synchronization, process isolation, network segmentation, memory settings, file descriptors, and privilege restrictions.

Key checks (run on each node):

• 2.1: NTP/chrony active, offsets below --max-offset (Automated)
• 2.2: One CockroachDB process per host (Automated)
• 2.3: Dedicated subnet with restricted ingress on ports 26257/8080 (Manual)
• 2.4: swapon --show | wc -l → 0 (Automated)
• 2.5: THP set to madvise or never (Automated)
• 2.6: File descriptor limit ≥ 15,000 for cockroach user (Automated)
• 2.7: cockroach user has no sudo privileges (Automated)

Step 3: Logging and Monitoring (Controls 3.1–3.4)

These controls verify logging configuration, rotation, authentication event capture, and monitoring/alerting.

Key checks:

• 3.1: Log directory exists, owned by cockroach, permissions 700 (Manual)
• 3.2: Log rotation configured via CockroachDB config or logrotate (Manual)
• 3.3: Both server.auth_log.sql_connections.enabled AND server.auth_log.sql_sessions.enabled = true (Automated)
• 3.4: Monitoring system scraping metrics, alerts configured (Manual)

Step 4: User Access and Authorization (Controls 4.1–4.4)

These controls verify host-based authentication, password security, root user hardening, and centralized identity management.

⚠️ Control 4.2 (Full Audit only): Inspecting stored password hashes requires SET allow_unsafe_internals = true. This is a break-glass, audit-only operation — run only in a dedicated admin session by authorized operators, and reset immediately after with SET allow_unsafe_internals = false. Do not expose this to application workloads.

Key checks (all SQL):

• 4.1: HBA has specific IP ranges, strong auth methods, reject catch-all (Manual)
• 4.2: password_encryption = scram-sha-256, stored hashes are SCRAM format (Manual)
• 4.3: Root restricted to specific hosts via HBA with cert method, activity audited (Manual)
• 4.4: OIDC/LDAP enabled, identity mapping configured, local accounts minimized (Manual)

Step 5: Data Protection (Controls 5.1–5.3)

These controls verify backup encryption, recovery testing, and multi-region data localization.

Key checks:

• 5.1: Backups use kms or encryption_passphrase, or storage-layer encryption enforced (Manual)
• 5.2: Recovery procedures tested quarterly with documented results (Manual)
• 5.3: Multi-region tables use REGIONAL BY ROW or zone constraints for data residency (Manual)

Step 6: CockroachDB Settings (Controls 6.1–6.5)

These controls verify certificate security, setting redaction, audit logging, session timeouts, and OCSP.

Key checks:

• 6.1: Private key permissions 0600, certs valid 90+ days (Automated)
• 6.2: Debug bundles use --redact, no secrets in logs (Manual)
• 6.3: sql.log.user_audit non-empty, sql.log.admin_audit.enabled = true, security channels configured (Manual)
• 6.4: sql.defaults.idle_in_session_timeout set (e.g., 15m) (Manual)
• 6.5: security.ocsp.mode = strict or lax (Manual)

Report Format

Generate a markdown report following the structure in sample report.

Status markers:

• [PASS] — Control is satisfied
• [FAIL] — Control is not satisfied, remediation required
• [MANUAL] — Requires human review; automated check cannot determine compliance
• [N/A] — Control does not apply (e.g., EAR without Enterprise license)

Relationship to Other Security Skills

For a broader security posture assessment (covering Cloud and self-hosted), use auditing-cloud-cluster-security.

Safety Considerations

• All operations are read-only. No cluster settings, OS configuration, or files are modified.
• Shell commands use read-only tools: ps, ls, cat, grep, systemctl is-enabled/is-active, swapon --show, ulimit, openssl x509, openssl verify.
• SQL queries use SHOW and SELECT only. No DDL or DML statements.
• One exception (4.2): The full audit procedure for password hash inspection requires SET allow_unsafe_internals = true — this is a read-only break-glass operation that must be reset immediately after (SET allow_unsafe_internals = false). Only authorized operators should run this step.
• No secrets are logged. Certificate private keys and passwords are not included in report output.
• Privilege check: Some SQL queries require admin or VIEWACTIVITY privilege. The report notes any permission gaps.

References

Skill references:

• CIS controls reference — All 30 controls with quick scan commands and full audit procedures
• SQL queries for CIS audit — All SQL queries used in the assessment
• Sample audit report — Example report with findings

Authoritative source:

• CIS CockroachDB Benchmark (official repo)

Related skills:

• auditing-cloud-cluster-security — Broader security posture assessment
• configuring-audit-logging — SQL audit logging setup
• hardening-user-privileges — RBAC tightening
• enforcing-password-policies — Password policy enforcement
• managing-tls-certificates — TLS certificate management
• enabling-cmek-encryption — Encryption at rest
• configuring-sso-and-scim — SSO and SCIM provisioning

Official CockroachDB documentation:

• Security Overview
• Recommended Production Settings
• Releases
• Security Advisories