CIS Couchbase 7 Benchmark

This recommendation verifies that external authentication is configured on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication settings:
couchbase-cli setting-ldap -c localhost:8091 -u admin -p $CB_PASS --get

# List local users:
couchbase-cli user-manage -c localhost:8091 -u admin -p $CB_PASS --list

# Configure LDAP authentication:
couchbase-cli setting-ldap -c localhost:8091 -u admin -p $CB_PASS \
  --authentication-enabled 1 \
  --hosts ldap.example.com \
  --port 636 \
  --encryption TLS \
  --bind-dn 'cn=couchbase,ou=svc,dc=example,dc=com' \
  --bind-password '$LDAP_BIND_PASS' \
  --user-dn-query 'ou=users,dc=example,dc=com??sub?(uid=%u)'

This recommendation verifies that RBAC roles follow least-privilege principles on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RBAC roles for users:
couchbase-cli user-manage -c localhost:8091 -u admin -p $CB_PASS --list | \
  jq '.[] | {id, name, roles: [.roles[].role]}'

# Create user with minimal role:
couchbase-cli user-manage -c localhost:8091 -u admin -p $CB_PASS \
  --set --rbac-username appuser \
  --rbac-password '$APP_PASS' \
  --roles data_reader[mybucket],data_writer[mybucket] \
  --auth-domain local

This recommendation ensures that strong password policy is enforced on the Couchbase 7 NoSQL database. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Couchbase 7 NoSQL database may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check password policy:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/security | \
  jq '{passwordPolicy: .passwordPolicy}'

# Set strong password policy:
curl -s -X POST -u admin:$CB_PASS \
  http://localhost:8091/settings/security \
  -d 'passwordPolicy.minLength=12' \
  -d 'passwordPolicy.mustContainUppercase=true' \
  -d 'passwordPolicy.mustContainLowercase=true' \
  -d 'passwordPolicy.mustContainDigit=true' \
  -d 'passwordPolicy.mustContainSpecialChar=true'

This recommendation verifies that TLS is configured for client connections on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/security | \
  jq '{clusterEncryptionLevel, disableUIOverHTTP, tlsMinVersion}'

# Enable cluster encryption:
couchbase-cli setting-security -c localhost:8091 -u admin -p $CB_PASS \
  --set --cluster-encryption-level all \
  --disable-http-ui 1 \
  --tls-min-version tlsv1.2

# Upload node certificates:
couchbase-cli ssl-manage -c localhost:8091 -u admin -p $CB_PASS \
  --upload-cluster-ca /etc/couchbase/ca.pem

This recommendation verifies that node-to-node encryption is enabled on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check inter-node encryption:
curl -s -u admin:$CB_PASS https://localhost:18091/settings/security | \
  jq '{clusterEncryptionLevel}'

# Enable node-to-node encryption:
couchbase-cli node-to-node-encryption -c localhost:8091 -u admin -p $CB_PASS \
  --enable

# Set encryption level to strict:
couchbase-cli setting-security -c localhost:8091 -u admin -p $CB_PASS \
  --set --cluster-encryption-level strict

This recommendation verifies that buckets have replication and flush protection on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check bucket configuration:
couchbase-cli bucket-list -c localhost:8091 -u admin -p $CB_PASS | \
  jq '.[] | {name, bucketType, replicaNumber, conflictResolutionType}'

# Create bucket with replication and access control:
couchbase-cli bucket-create -c localhost:8091 -u admin -p $CB_PASS \
  --bucket mybucket \
  --bucket-type couchbase \
  --bucket-ramsize 512 \
  --bucket-replica 2 \
  --enable-flush 0 \
  --compression-mode active

This recommendation verifies that XDCR uses full encryption on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check XDCR configuration:
curl -s -u admin:$CB_PASS http://localhost:8091/pools/default/remoteClusters | jq .

# Check XDCR security:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/replications | jq .

# Configure XDCR with full encryption:
couchbase-cli xdcr-setup -c localhost:8091 -u admin -p $CB_PASS \
  --create --xdcr-cluster-name remote-dc \
  --xdcr-hostname remote.example.com:8091 \
  --xdcr-username repl_user \
  --xdcr-password '$REPL_PASS' \
  --xdcr-demand-encryption 1 \
  --xdcr-encryption-type full \
  --xdcr-certificate /etc/couchbase/remote-ca.pem

This recommendation verifies that audit logging is enabled with rotation on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit configuration:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/audit | jq .

# Enable comprehensive auditing:
curl -s -X POST -u admin:$CB_PASS \
  http://localhost:8091/settings/audit \
  -d 'auditdEnabled=true' \
  -d 'rotateInterval=86400' \
  -d 'rotateSize=20971520' \
  -d 'logPath=/opt/couchbase/var/lib/couchbase/logs'

This recommendation verifies that log redaction is configured for sensitive data on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check log redaction setting:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/logRedaction | jq .

# Enable log redaction for sensitive data:
curl -s -X POST -u admin:$CB_PASS \
  http://localhost:8091/settings/logRedaction \
  -d 'logRedactionLevel=partial'

# Collect support bundle with redaction:
couchbase-cli collect-logs-start -c localhost:8091 -u admin -p $CB_PASS \
  --redaction-level partial

This recommendation verifies that auto-failover is configured on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check auto-failover settings:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/autoFailover | jq .

# Configure auto-failover:
couchbase-cli setting-autofailover -c localhost:8091 -u admin -p $CB_PASS \
  --enable-auto-failover 1 \
  --auto-failover-timeout 120 \
  --max-failovers 2 \
  --enable-failover-of-server-groups 0

This recommendation verifies that automated backups are configured with cbbackupmgr on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
cbbackupmgr config --archive /opt/couchbase/backups --list-repos

# Check backup schedule:
cbbackupmgr config --archive /opt/couchbase/backups --repo myrepo --list-plans

# Configure automated backups:
cbbackupmgr config --archive /opt/couchbase/backups --repo myrepo

cbbackupmgr config --archive /opt/couchbase/backups --repo myrepo \
  --backup-plan 'full_weekly' \
  --schedule '0 2 * * 0' \
  --type FULL

cbbackupmgr config --archive /opt/couchbase/backups --repo myrepo \
  --backup-plan 'incr_daily' \
  --schedule '0 2 * * 1-6' \
  --type INCR

This recommendation verifies that N1QL query service has resource limits on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check query service settings:
curl -s -u admin:$CB_PASS http://localhost:8093/admin/settings | jq .

# Configure N1QL query security:
curl -s -X POST -u admin:$CB_PASS \
  http://localhost:8093/admin/settings \
  -d '{"completed-limit": 4000, "completed-threshold": 1000, "log-level": "info", "pipeline-cap": 512, "scan-cap": 512, "timeout": "5m"}'

This setting ensures that Full-Text Search access is restricted via RBAC on the Couchbase 7 NoSQL database. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Couchbase 7 NoSQL database is essential for defense in depth.

# Check FTS (Full-Text Search) settings:
curl -s -u admin:$CB_PASS http://localhost:8094/api/manager | jq .

# Secure FTS service with TLS:
couchbase-cli setting-security -c localhost:8091 -u admin -p $CB_PASS \
  --set --cluster-encryption-level all

# Restrict FTS to specific buckets via RBAC:
couchbase-cli user-manage -c localhost:8091 -u admin -p $CB_PASS \
  --set --rbac-username fts_user \
  --rbac-password '$FTS_PASS' \
  --roles fts_searcher[mybucket] \
  --auth-domain local

This recommendation verifies that auto-compaction thresholds are configured on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check disk I/O and compaction settings:
curl -s -u admin:$CB_PASS http://localhost:8091/settings/autoCompaction | jq .

# Configure auto-compaction:
curl -s -X POST -u admin:$CB_PASS \
  http://localhost:8091/controller/setAutoCompaction \
  -d 'databaseFragmentationThreshold[percentage]=30' \
  -d 'viewFragmentationThreshold[percentage]=30' \
  -d 'parallelDBAndViewCompaction=false'

This recommendation verifies that per-service memory quotas are set on the Couchbase 7 NoSQL database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Couchbase 7 NoSQL database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check node resource allocation:
curl -s -u admin:$CB_PASS http://localhost:8091/pools/default | \
  jq '{storageTotals, ramQuota: .nodes[0].memoryQuota}'

# Set per-service memory quotas:
couchbase-cli setting-cluster -c localhost:8091 -u admin -p $CB_PASS \
  --cluster-ramsize 8192 \
  --cluster-index-ramsize 2048 \
  --cluster-fts-ramsize 1024 \
  --cluster-eventing-ramsize 512