From 23d774439fb0c6c4768d8071b91a2acf3df54144 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 18 Jul 2022 17:11:15 -0700 Subject: [PATCH] Enclose in backticks so <&tag> aren't processed as HTML tags - 2 --- .../rke-1.6-benchmark-2.6.md | 40 +++++------ .../rke2-1.6-benchmark-2.6.md | 44 ++++++------ .../benchmark-2.3.5/benchmark-2.3.5.md | 70 +++++++++---------- .../benchmark-2.4/benchmark-2.4.md | 70 +++++++++---------- .../1.5-benchmark-2.5/1.5-benchmark-2.5.md | 30 ++++---- .../1.6-benchmark-2.5/1.6-benchmark-2.5.md | 60 ++++++++-------- .../rke-1.6-benchmark-2.6.md | 40 +++++------ .../rke2-1.6-benchmark-2.6.md | 44 ++++++------ 8 files changed, 199 insertions(+), 199 deletions(-) diff --git a/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md b/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md index 2f4f1d724fa..f6bd2a79028 100644 --- a/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md +++ b/docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md @@ -677,8 +677,8 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= +`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. +`--kubelet-certificate-authority=` **Audit:** @@ -1288,7 +1288,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: ---service-account-key-file= +`--service-account-key-file=` **Audit:** @@ -1317,8 +1317,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` **Audit:** @@ -1347,8 +1347,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` **Audit:** @@ -1377,7 +1377,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. ---client-ca-file= +`--client-ca-file=` **Audit:** @@ -1406,7 +1406,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= +`--etcd-cafile=` **Audit:** @@ -1626,7 +1626,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10. Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +`--service-account-private-key-file=` **Audit:** @@ -1654,7 +1654,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10. **Remediation:** Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +`--root-ca-file=` **Audit:** @@ -1779,8 +1779,8 @@ root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernete Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` **Audit:** @@ -1866,8 +1866,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` **Audit:** @@ -1954,7 +1954,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +`--trusted-ca-file=` **Audit:** @@ -2145,7 +2145,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` **Audit Script:** `check_cafile_permissions.sh` @@ -2305,7 +2305,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +`--client-ca-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2526,8 +2526,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service diff --git a/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md b/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md index 76297744ffa..f97cec92319 100644 --- a/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md +++ b/docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md @@ -869,8 +869,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= +`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. +`--kubelet-certificate-authority=` **Audit:** @@ -1468,7 +1468,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: ---service-account-key-file= +`--service-account-key-file=` **Audit:** @@ -1497,8 +1497,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` **Audit:** @@ -1527,8 +1527,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` **Audit:** @@ -1557,7 +1557,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. ---client-ca-file= +`--client-ca-file=` **Audit:** @@ -1586,7 +1586,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= +`--etcd-cafile=` **Audit:** @@ -1787,7 +1787,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the master node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +`--service-account-private-key-file=` **Audit:** @@ -1815,7 +1815,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d **Remediation:** Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +`--root-ca-file=` **Audit:** @@ -1938,8 +1938,8 @@ root 5533 5414 0 14:58 ? 00:00:02 kube-scheduler --permit-port-sharing=true --ad Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) @@ -1989,8 +1989,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) @@ -2041,7 +2041,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +`--trusted-ca-file=` **Audit:** @@ -2258,7 +2258,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` **Audit:** @@ -2438,7 +2438,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +`--client-ca-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2693,8 +2693,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2929,7 +2929,7 @@ echo "true" **Audit Execution:** ```bash -./check_for_default_sa.sh +./check_for_default_sa.sh ``` **Expected Result**: @@ -3228,7 +3228,7 @@ echo "true" **Audit Execution:** ```bash -./check_for_rke2_network_policies.sh +./check_for_rke2_network_policies.sh ``` **Expected Result**: diff --git a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/benchmark-2.3.5.md b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/benchmark-2.3.5.md index 3fbb7f27f16..f6331e1176e 100644 --- a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/benchmark-2.3.5.md +++ b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/benchmark-2.3.5.md @@ -39,7 +39,7 @@ When performing the tests, you will need access to the Docker command line on th --- ## 1 Master Node Security Configuration -### 1.1 Master Node Configuration Files +### 1.1 Master Node Configuration Files #### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored) @@ -155,7 +155,7 @@ Run the below command (based on the etcd data directory found above). For example, ``` bash chown etcd:etcd /var/lib/etcd -``` +``` **Audit Script:** 1.1.12.sh @@ -189,7 +189,7 @@ docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run. We recommend that this `kube_config_cluster.yml` file be kept in secure store. -#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) +#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) **Result:** Not Applicable @@ -249,7 +249,7 @@ stat -c %U:%G /etc/kubernetes/ssl 'root:root' is present ``` -#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) +#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) **Result:** PASS @@ -732,7 +732,7 @@ on the master node and set the below parameter. '0' is equal to '0' ``` -#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) +#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) **Result:** PASS @@ -938,7 +938,7 @@ on the master node and set the `--service-account-key-file` parameter to the public key file for service accounts: ``` bash ---service-account-key-file= +`--service-account-key-file=` ``` **Audit:** @@ -953,7 +953,7 @@ to the public key file for service accounts: '--service-account-key-file' is present ``` -#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) +#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) **Result:** PASS @@ -963,8 +963,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the **etcd** certificate and **key** file parameters. ``` bash ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` ``` **Audit:** @@ -989,8 +989,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the TLS certificate and private key file parameters. ``` bash ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` ``` **Audit:** @@ -1015,7 +1015,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the client certificate authority file. ``` bash ---client-ca-file= +`--client-ca-file=` ``` **Audit:** @@ -1040,7 +1040,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the etcd certificate authority file parameter. ``` bash ---etcd-cafile= +`--etcd-cafile=` ``` **Audit:** @@ -1202,7 +1202,7 @@ on the master node and set the `--service-account-private-key-file` parameter to the private key file for service accounts. ``` bash ---service-account-private-key-file= +`--service-account-private-key-file=` ``` **Audit:** @@ -1226,7 +1226,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku on the master node and set the `--root-ca-file` parameter to the certificate bundle file`. ``` bash ---root-ca-file= +`--root-ca-file=` ``` **Audit:** @@ -1311,7 +1311,7 @@ on the master node and set the below parameter. 'false' is equal to 'false' ``` -#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) +#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) **Result:** PASS @@ -1344,8 +1344,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameters. ``` bash ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` ``` **Audit:** @@ -1418,8 +1418,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet master node and set the below parameters. ``` bash ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` ``` **Audit:** @@ -1485,7 +1485,7 @@ node and either remove the `--peer-auto-tls` parameter or set it to `false`. ## 3 Control Plane Configuration ### 3.2 Logging -#### 3.2.1 Ensure that a minimal audit policy is created (Scored) +#### 3.2.1 Ensure that a minimal audit policy is created (Scored) **Result:** PASS @@ -1546,7 +1546,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected result**: @@ -1561,7 +1561,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Remediation:** Run the below command (based on the file location on your system) on the each worker node. -For example, +For example, ``` bash chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml @@ -1570,7 +1570,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected result**: @@ -1594,7 +1594,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected result**: @@ -1618,7 +1618,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected result**: @@ -1635,7 +1635,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml Run the following command to modify the file permissions of the ``` bash ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` ``` **Audit:** @@ -1664,7 +1664,7 @@ chown root:root **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' ``` **Expected result**: @@ -1703,7 +1703,7 @@ set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. ``` bash --anonymous-auth=false ``` - + Based on your system, restart the kubelet service. For example: ``` bash @@ -1780,7 +1780,7 @@ If using command line arguments, edit the kubelet service file set the below parameter in `KUBELET_AUTHZ_ARGS` variable. ``` bash ---client-ca-file= +`--client-ca-file=` ``` Based on your system, restart the kubelet service. For example: @@ -1926,7 +1926,7 @@ systemctl restart kubelet.service 'true' is equal to 'true' ``` -#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) +#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) **Result:** PASS @@ -1938,7 +1938,7 @@ remove the `--make-iptables-util-chains` argument from the `KUBELET_SYSTEM_PODS_ARGS` variable. Based on your system, restart the kubelet service. For example: -```bash +```bash systemctl daemon-reload systemctl restart kubelet.service ``` @@ -2091,7 +2091,7 @@ exit 0 **Audit Execution:** ``` -./5.1.5.sh +./5.1.5.sh ``` **Expected result**: @@ -2218,7 +2218,7 @@ echo "pass" **Audit Execution:** ``` -./5.3.2.sh +./5.3.2.sh ``` **Expected result**: @@ -2258,7 +2258,7 @@ echo "--count=${default_resources}" **Audit Execution:** ``` -./5.6.4.sh +./5.6.4.sh ``` **Expected result**: diff --git a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.4/benchmark-2.4/benchmark-2.4.md b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.4/benchmark-2.4/benchmark-2.4.md index f1e0767ab99..6c9debdaf14 100644 --- a/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.4/benchmark-2.4/benchmark-2.4.md +++ b/versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.4/benchmark-2.4/benchmark-2.4.md @@ -39,7 +39,7 @@ When performing the tests, you will need access to the Docker command line on th --- ## 1 Master Node Security Configuration -### 1.1 Master Node Configuration Files +### 1.1 Master Node Configuration Files #### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored) @@ -155,7 +155,7 @@ Run the below command (based on the etcd data directory found above). For example, ``` bash chown etcd:etcd /var/lib/etcd -``` +``` **Audit Script:** 1.1.12.sh @@ -189,7 +189,7 @@ docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run. We recommend that this `kube_config_cluster.yml` file be kept in secure store. -#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) +#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) **Result:** Not Applicable @@ -249,7 +249,7 @@ stat -c %U:%G /etc/kubernetes/ssl 'root:root' is present ``` -#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) +#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) **Result:** PASS @@ -732,7 +732,7 @@ on the master node and set the below parameter. '0' is equal to '0' ``` -#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) +#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) **Result:** PASS @@ -938,7 +938,7 @@ on the master node and set the `--service-account-key-file` parameter to the public key file for service accounts: ``` bash ---service-account-key-file= +`--service-account-key-file=` ``` **Audit:** @@ -953,7 +953,7 @@ to the public key file for service accounts: '--service-account-key-file' is present ``` -#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) +#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) **Result:** PASS @@ -963,8 +963,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the **etcd** certificate and **key** file parameters. ``` bash ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` ``` **Audit:** @@ -989,8 +989,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the TLS certificate and private key file parameters. ``` bash ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` ``` **Audit:** @@ -1015,7 +1015,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the client certificate authority file. ``` bash ---client-ca-file= +`--client-ca-file=` ``` **Audit:** @@ -1040,7 +1040,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the etcd certificate authority file parameter. ``` bash ---etcd-cafile= +`--etcd-cafile=` ``` **Audit:** @@ -1202,7 +1202,7 @@ on the master node and set the `--service-account-private-key-file` parameter to the private key file for service accounts. ``` bash ---service-account-private-key-file= +`--service-account-private-key-file=` ``` **Audit:** @@ -1226,7 +1226,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku on the master node and set the `--root-ca-file` parameter to the certificate bundle file`. ``` bash ---root-ca-file= +`--root-ca-file=` ``` **Audit:** @@ -1311,7 +1311,7 @@ on the master node and set the below parameter. 'false' is equal to 'false' ``` -#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) +#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) **Result:** PASS @@ -1344,8 +1344,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameters. ``` bash ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` ``` **Audit:** @@ -1418,8 +1418,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet master node and set the below parameters. ``` bash ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` ``` **Audit:** @@ -1485,7 +1485,7 @@ node and either remove the `--peer-auto-tls` parameter or set it to `false`. ## 3 Control Plane Configuration ### 3.2 Logging -#### 3.2.1 Ensure that a minimal audit policy is created (Scored) +#### 3.2.1 Ensure that a minimal audit policy is created (Scored) **Result:** PASS @@ -1546,7 +1546,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected result**: @@ -1561,7 +1561,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Remediation:** Run the below command (based on the file location on your system) on the each worker node. -For example, +For example, ``` bash chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml @@ -1570,7 +1570,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected result**: @@ -1594,7 +1594,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected result**: @@ -1618,7 +1618,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected result**: @@ -1635,7 +1635,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml Run the following command to modify the file permissions of the ``` bash ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` ``` **Audit:** @@ -1664,7 +1664,7 @@ chown root:root **Audit:** ``` -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' ``` **Expected result**: @@ -1703,7 +1703,7 @@ set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable. ``` bash --anonymous-auth=false ``` - + Based on your system, restart the kubelet service. For example: ``` bash @@ -1780,7 +1780,7 @@ If using command line arguments, edit the kubelet service file set the below parameter in `KUBELET_AUTHZ_ARGS` variable. ``` bash ---client-ca-file= +`--client-ca-file=` ``` Based on your system, restart the kubelet service. For example: @@ -1926,7 +1926,7 @@ systemctl restart kubelet.service 'true' is equal to 'true' ``` -#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) +#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) **Result:** PASS @@ -1938,7 +1938,7 @@ remove the `--make-iptables-util-chains` argument from the `KUBELET_SYSTEM_PODS_ARGS` variable. Based on your system, restart the kubelet service. For example: -```bash +```bash systemctl daemon-reload systemctl restart kubelet.service ``` @@ -2091,7 +2091,7 @@ exit 0 **Audit Execution:** ``` -./5.1.5.sh +./5.1.5.sh ``` **Expected result**: @@ -2218,7 +2218,7 @@ echo "pass" **Audit Execution:** ``` -./5.3.2.sh +./5.3.2.sh ``` **Expected result**: @@ -2258,7 +2258,7 @@ echo "--count=${default_resources}" **Audit Execution:** ``` -./5.6.4.sh +./5.6.4.sh ``` **Expected result**: diff --git a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md index 4fed8f40550..07859da7ca8 100644 --- a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md +++ b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md @@ -937,7 +937,7 @@ on the master node and set the `--service-account-key-file` parameter to the public key file for service accounts: ``` bash ---service-account-key-file= +`--service-account-key-file=` ``` **Audit:** @@ -962,8 +962,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the **etcd** certificate and **key** file parameters. ``` bash ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` ``` **Audit:** @@ -988,8 +988,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the TLS certificate and private key file parameters. ``` bash ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` ``` **Audit:** @@ -1014,7 +1014,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the client certificate authority file. ``` bash ---client-ca-file= +`--client-ca-file=` ``` **Audit:** @@ -1039,7 +1039,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube on the master node and set the etcd certificate authority file parameter. ``` bash ---etcd-cafile= +`--etcd-cafile=` ``` **Audit:** @@ -1201,7 +1201,7 @@ on the master node and set the `--service-account-private-key-file` parameter to the private key file for service accounts. ``` bash ---service-account-private-key-file= +`--service-account-private-key-file=` ``` **Audit:** @@ -1225,7 +1225,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku on the master node and set the `--root-ca-file` parameter to the certificate bundle file`. ``` bash ---root-ca-file= +`--root-ca-file=` ``` **Audit:** @@ -1343,8 +1343,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master node and set the below parameters. ``` bash ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` ``` **Audit:** @@ -1417,8 +1417,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet master node and set the below parameters. ``` bash ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` ``` **Audit:** @@ -1634,7 +1634,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml Run the following command to modify the file permissions of the ``` bash ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` ``` **Audit:** @@ -1779,7 +1779,7 @@ If using command line arguments, edit the kubelet service file set the below parameter in `KUBELET_AUTHZ_ARGS` variable. ``` bash ---client-ca-file= +`--client-ca-file=` ``` Based on your system, restart the kubelet service. For example: diff --git a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md index e0dc1e45c5d..f435c8471fa 100644 --- a/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md +++ b/versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md @@ -173,7 +173,7 @@ exit true ``` -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) **Result:** pass @@ -766,8 +766,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= +`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. +`--kubelet-certificate-authority=` **Audit:** @@ -1379,7 +1379,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: ---service-account-key-file= +`--service-account-key-file=` **Audit:** @@ -1408,8 +1408,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` **Audit:** @@ -1438,8 +1438,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` **Audit:** @@ -1468,7 +1468,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. ---client-ca-file= +`--client-ca-file=` **Audit:** @@ -1497,7 +1497,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= +`--etcd-cafile=` **Audit:** @@ -1717,7 +1717,7 @@ root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --co Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +`--service-account-private-key-file=` **Audit:** @@ -1745,7 +1745,7 @@ root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --co **Remediation:** Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +`--root-ca-file=` **Audit:** @@ -1877,8 +1877,8 @@ root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig= Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` **Audit:** @@ -1973,8 +1973,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` **Audit:** @@ -2070,7 +2070,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +`--trusted-ca-file=` **Audit:** @@ -2167,7 +2167,7 @@ All configuration is passed in as arguments at container run time. **Audit:** ```bash -/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' +/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' ``` @@ -2183,7 +2183,7 @@ All configuration is passed in as arguments at container run time. **Audit:** ```bash -/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' +/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' ``` @@ -2200,7 +2200,7 @@ chmod 644 $proykubeconfig **Audit:** ```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected Result**: @@ -2227,7 +2227,7 @@ For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml **Audit:** ```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' ``` **Expected Result**: @@ -2249,7 +2249,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected Result**: @@ -2271,7 +2271,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml **Audit:** ```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' ``` **Expected Result**: @@ -2292,7 +2292,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` **Audit:** @@ -2361,7 +2361,7 @@ All configuration is passed in as arguments at container run time. **Audit:** ```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi' +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi' ``` @@ -2380,7 +2380,7 @@ All configuration is passed in as arguments at container run time. **Audit:** ```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi' +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi' ``` @@ -2450,7 +2450,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +`--client-ca-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2602,7 +2602,7 @@ Clusters provisioned by RKE set the --hostname-override to avoid any hostname co **Audit:** ```bash -/bin/ps -fC kubelet +/bin/ps -fC kubelet ``` @@ -2643,8 +2643,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service diff --git a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md index 02b68e4a0e5..6dc2904182f 100644 --- a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md +++ b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md @@ -673,8 +673,8 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= +`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. +`--kubelet-certificate-authority=` **Audit:** @@ -1284,7 +1284,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: ---service-account-key-file= +`--service-account-key-file=` **Audit:** @@ -1313,8 +1313,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` **Audit:** @@ -1343,8 +1343,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` **Audit:** @@ -1373,7 +1373,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. ---client-ca-file= +`--client-ca-file=` **Audit:** @@ -1402,7 +1402,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= +`--etcd-cafile=` **Audit:** @@ -1622,7 +1622,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10. Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +`--service-account-private-key-file=` **Audit:** @@ -1650,7 +1650,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10. **Remediation:** Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +`--root-ca-file=` **Audit:** @@ -1775,8 +1775,8 @@ root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernete Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` **Audit:** @@ -1862,8 +1862,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` **Audit:** @@ -1950,7 +1950,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +`--trusted-ca-file=` **Audit:** @@ -2141,7 +2141,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` **Audit Script:** `check_cafile_permissions.sh` @@ -2301,7 +2301,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +`--client-ca-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2522,8 +2522,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service diff --git a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md index 39c4c3409f3..8e4fc25bbfd 100644 --- a/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md +++ b/versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md @@ -865,8 +865,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= +`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority. +`--kubelet-certificate-authority=` **Audit:** @@ -1464,7 +1464,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: ---service-account-key-file= +`--service-account-key-file=` **Audit:** @@ -1493,8 +1493,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +`--etcd-certfile=` +`--etcd-keyfile=` **Audit:** @@ -1523,8 +1523,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` **Audit:** @@ -1553,7 +1553,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. ---client-ca-file= +`--client-ca-file=` **Audit:** @@ -1582,7 +1582,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. ---etcd-cafile= +`--etcd-cafile=` **Audit:** @@ -1783,7 +1783,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the master node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +`--service-account-private-key-file=` **Audit:** @@ -1811,7 +1811,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d **Remediation:** Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +`--root-ca-file=` **Audit:** @@ -1934,8 +1934,8 @@ root 5533 5414 0 14:58 ? 00:00:02 kube-scheduler --permit-port-sharing=true --ad Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +`--cert-file=` +`--key-file=` ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) @@ -1985,8 +1985,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +`--peer-client-file=` +`--peer-key-file=` ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) @@ -2037,7 +2037,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +`--trusted-ca-file=` **Audit:** @@ -2254,7 +2254,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 644 +`--client-ca-file chmod 644 ` **Audit:** @@ -2434,7 +2434,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +`--client-ca-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2689,8 +2689,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +`--tls-cert-file=` +`--tls-private-key-file=` Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service @@ -2925,7 +2925,7 @@ echo "true" **Audit Execution:** ```bash -./check_for_default_sa.sh +./check_for_default_sa.sh ``` **Expected Result**: @@ -3224,7 +3224,7 @@ echo "true" **Audit Execution:** ```bash -./check_for_rke2_network_policies.sh +./check_for_rke2_network_policies.sh ``` **Expected Result**: