From cbf320ed001556ea42098e9ccc6b2ba09214ef3b Mon Sep 17 00:00:00 2001 From: Pietro Dell'Amore Date: Tue, 15 Jul 2025 11:41:40 -0300 Subject: [PATCH 1/5] Add new sections to Rancher Security Best Practices --- .../rancher-security-best-practices.md | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md index fa958639c1f..b6a45930cc3 100644 --- a/docs/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -28,3 +28,52 @@ You should protect the following ports behind an [external load balancer](../../ - **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers. + +## Rancher Username Policy + +By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. + +Examples of potential baseline policies include: +- Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) +- Enforcing minimum or maximum length requirements +- Disallowing certain special characters +- Preventing impersonation by disallowing reserved names (e.g., `admin`, `root`) + +Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. + +**Recommendation:** +We strongly recommend that customers: +- Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). +- Ensure that those policies align with the organization’s security and compliance requirements. +- Regularly audit user accounts to detect naming inconsistencies or policy violations. + +For more information, see: +- [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) +- [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) + +## WAF Rules + +Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. + +For example: +- CI/CD pipelines may create and tear down clusters frequently. +- Self-service portals could provision clusters on-demand for developers. +- Test environments may generate high volumes of API calls. + +**Risk:** +Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: +- Exhaust resources (Denial of Service). +- Inflate storage costs. +- Degrade performance for legitimate users. + +**Recommendation:** +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. + +We recommend: +- Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. +- Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). +- Monitoring logs and alerting on anomalies to detect potential abuse. + +For more information, see: +- [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) From bdd3b908047b21e3d0d027250cc8b963189efc66 Mon Sep 17 00:00:00 2001 From: Pietro Dell'Amore Date: Tue, 22 Jul 2025 12:09:49 -0300 Subject: [PATCH 2/5] Improve sections writing --- .../rancher-security-best-practices.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md index b6a45930cc3..e390daf55cf 100644 --- a/docs/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -33,6 +33,8 @@ These ports have TLS SAN certificates which list nodes' public IP addresses. An By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/bootstrap-password) + Examples of potential baseline policies include: - Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) - Enforcing minimum or maximum length requirements @@ -41,8 +43,10 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. +Important: Rancher currently enforces only a [minimum password length](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length) + **Recommendation:** -We strongly recommend that customers: +We strongly advice that customers: - Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). - Ensure that those policies align with the organization’s security and compliance requirements. - Regularly audit user accounts to detect naming inconsistencies or policy violations. @@ -67,13 +71,14 @@ Without appropriate rate limiting, adversaries could exploit unauthenticated or - Degrade performance for legitimate users. **Recommendation:** -The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. Some examples of controls can be: -We recommend: - Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. - Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). - Monitoring logs and alerting on anomalies to detect potential abuse. +- Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. For more information, see: +- [Project Resource Quotas](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas) - [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) - [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) From 8ff2134ee04e24fb34730543525de9e01eec0a9d Mon Sep 17 00:00:00 2001 From: Pietro Dell'Amore Date: Wed, 6 Aug 2025 09:14:51 -0300 Subject: [PATCH 3/5] Add docs team suggestions --- .../rancher-security-best-practices.md | 15 ++-- .../rancher-security-best-practices.md | 61 ++++++++++++++++ .../rancher-security-best-practices.md | 61 ++++++++++++++++ .../rancher-security-best-practices.md | 61 ++++++++++++++++ .../rancher-security-best-practices.md | 70 +++++++++++++++++++ 5 files changed, 264 insertions(+), 4 deletions(-) diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md index e390daf55cf..5b67aede622 100644 --- a/docs/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -33,9 +33,10 @@ These ports have TLS SAN certificates which list nodes' public IP addresses. An By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. -In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/bootstrap-password) +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](../../getting-started/installation-and-upgrade/resources/bootstrap-password.md) Examples of potential baseline policies include: + - Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) - Enforcing minimum or maximum length requirements - Disallowing certain special characters @@ -43,15 +44,18 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -Important: Rancher currently enforces only a [minimum password length](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length) +> [!IMPORTANT] +> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) **Recommendation:** We strongly advice that customers: + - Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). - Ensure that those policies align with the organization’s security and compliance requirements. - Regularly audit user accounts to detect naming inconsistencies or policy violations. For more information, see: + - [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) - [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) @@ -60,12 +64,14 @@ For more information, see: Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. For example: + - CI/CD pipelines may create and tear down clusters frequently. - Self-service portals could provision clusters on-demand for developers. - Test environments may generate high volumes of API calls. **Risk:** Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: + - Exhaust resources (Denial of Service). - Inflate storage costs. - Degrade performance for legitimate users. @@ -79,6 +85,7 @@ The most effective way to mitigate this risk is to implement rate limiting and a - Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. For more information, see: -- [Project Resource Quotas](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas) + +- [Project Resource Quotas](../../how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md) - [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) -- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) \ No newline at end of file diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md index fa958639c1f..5b67aede622 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md @@ -28,3 +28,64 @@ You should protect the following ports behind an [external load balancer](../../ - **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers. + +## Rancher Username Policy + +By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. + +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](../../getting-started/installation-and-upgrade/resources/bootstrap-password.md) + +Examples of potential baseline policies include: + +- Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) +- Enforcing minimum or maximum length requirements +- Disallowing certain special characters +- Preventing impersonation by disallowing reserved names (e.g., `admin`, `root`) + +Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. + +> [!IMPORTANT] +> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) + +**Recommendation:** +We strongly advice that customers: + +- Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). +- Ensure that those policies align with the organization’s security and compliance requirements. +- Regularly audit user accounts to detect naming inconsistencies or policy violations. + +For more information, see: + +- [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) +- [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) + +## WAF Rules + +Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. + +For example: + +- CI/CD pipelines may create and tear down clusters frequently. +- Self-service portals could provision clusters on-demand for developers. +- Test environments may generate high volumes of API calls. + +**Risk:** +Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: + +- Exhaust resources (Denial of Service). +- Inflate storage costs. +- Degrade performance for legitimate users. + +**Recommendation:** +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. Some examples of controls can be: + +- Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. +- Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). +- Monitoring logs and alerting on anomalies to detect potential abuse. +- Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. + +For more information, see: + +- [Project Resource Quotas](../../how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md) +- [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) \ No newline at end of file diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md index fa958639c1f..5b67aede622 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md @@ -28,3 +28,64 @@ You should protect the following ports behind an [external load balancer](../../ - **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers. + +## Rancher Username Policy + +By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. + +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](../../getting-started/installation-and-upgrade/resources/bootstrap-password.md) + +Examples of potential baseline policies include: + +- Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) +- Enforcing minimum or maximum length requirements +- Disallowing certain special characters +- Preventing impersonation by disallowing reserved names (e.g., `admin`, `root`) + +Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. + +> [!IMPORTANT] +> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) + +**Recommendation:** +We strongly advice that customers: + +- Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). +- Ensure that those policies align with the organization’s security and compliance requirements. +- Regularly audit user accounts to detect naming inconsistencies or policy violations. + +For more information, see: + +- [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) +- [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) + +## WAF Rules + +Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. + +For example: + +- CI/CD pipelines may create and tear down clusters frequently. +- Self-service portals could provision clusters on-demand for developers. +- Test environments may generate high volumes of API calls. + +**Risk:** +Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: + +- Exhaust resources (Denial of Service). +- Inflate storage costs. +- Degrade performance for legitimate users. + +**Recommendation:** +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. Some examples of controls can be: + +- Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. +- Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). +- Monitoring logs and alerting on anomalies to detect potential abuse. +- Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. + +For more information, see: + +- [Project Resource Quotas](../../how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md) +- [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) \ No newline at end of file diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md index fa958639c1f..5b67aede622 100644 --- a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md @@ -28,3 +28,64 @@ You should protect the following ports behind an [external load balancer](../../ - **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers. + +## Rancher Username Policy + +By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. + +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](../../getting-started/installation-and-upgrade/resources/bootstrap-password.md) + +Examples of potential baseline policies include: + +- Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) +- Enforcing minimum or maximum length requirements +- Disallowing certain special characters +- Preventing impersonation by disallowing reserved names (e.g., `admin`, `root`) + +Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. + +> [!IMPORTANT] +> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) + +**Recommendation:** +We strongly advice that customers: + +- Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). +- Ensure that those policies align with the organization’s security and compliance requirements. +- Regularly audit user accounts to detect naming inconsistencies or policy violations. + +For more information, see: + +- [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) +- [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) + +## WAF Rules + +Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. + +For example: + +- CI/CD pipelines may create and tear down clusters frequently. +- Self-service portals could provision clusters on-demand for developers. +- Test environments may generate high volumes of API calls. + +**Risk:** +Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: + +- Exhaust resources (Denial of Service). +- Inflate storage costs. +- Degrade performance for legitimate users. + +**Recommendation:** +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. Some examples of controls can be: + +- Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. +- Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). +- Monitoring logs and alerting on anomalies to detect potential abuse. +- Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. + +For more information, see: + +- [Project Resource Quotas](../../how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md) +- [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) \ No newline at end of file diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md index df921789f25..f68d6e965ef 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md @@ -19,3 +19,73 @@ See [OWASP Web Application Security Testing - Enumerate Infrastructure and Appli Some environments may require additional security controls for session management. For example, you may want to limit users' concurrent active sessions or restrict which geolocations those sessions can be initiated from. Such features are not supported by Rancher out of the box. If you require such features, combine Layer 7 firewalls with [external authentication providers](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/authentication-config.md#external-vs-local-authentication). + +## Use External Load Balancers to Protect Vulnerable Ports + +You should protect the following ports behind an [external load balancer](../../how-to-guides/new-user-guides/kubernetes-resources-setup/load-balancer-and-ingress-controller/layer-4-and-layer-7-load-balancing.md#layer-4-load-balancer) that has SSL offload enabled: + +- **K3s:** Port 6443, used by the Kubernetes API. +- **RKE and RKE2:** Port 6443, used by the Kubernetes API, and port 9345, used for node registration. + +These ports have TLS SAN certificates which list nodes' public IP addresses. An attacker could use that information to gain unauthorized access or monitor activity on the cluster. Protecting these ports helps mitigate against nodes' public IP addresses being disclosed to potential attackers. + +## Rancher Username Policy + +By default, Kubernetes does not provide enforcement mechanisms for baseline username policies. In Rancher, this means that any enforcement of username formats, naming conventions, or baseline policies is expected to be handled by the external identity provider's policies, if such policies are in place. + +In Rancher, `admin` is the default username for the Administrator user, as highlighted [here](../../getting-started/installation-and-upgrade/resources/bootstrap-password.md) + +Examples of potential baseline policies include: + +- Requiring usernames to follow an organizational convention (e.g., `firstname.lastname`) +- Enforcing minimum or maximum length requirements +- Disallowing certain special characters +- Preventing impersonation by disallowing reserved names (e.g., `admin`, `root`) + +Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. + +> [!IMPORTANT] +> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) + +**Recommendation:** +We strongly advice that customers: + +- Review and configure username baseline policies directly in their external identity providers (e.g., LDAP, Active Directory, SAML, or OIDC). +- Ensure that those policies align with the organization’s security and compliance requirements. +- Regularly audit user accounts to detect naming inconsistencies or policy violations. + +For more information, see: + +- [OWASP Cheat Sheet: Authentication](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html) +- [OWASP Identity Management](https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication) + +## WAF Rules + +Rancher is designed to support a wide range of deployment scenarios, including environments where customers may programmatically automate the creation or provisioning of large numbers of clusters. Imposing strict application-level limits within Rancher itself could interfere with legitimate workloads that require dynamic scaling. + +For example: + +- CI/CD pipelines may create and tear down clusters frequently. +- Self-service portals could provision clusters on-demand for developers. +- Test environments may generate high volumes of API calls. + +**Risk:** +Without appropriate rate limiting, adversaries could exploit unauthenticated or authenticated endpoints to: + +- Exhaust resources (Denial of Service). +- Inflate storage costs. +- Degrade performance for legitimate users. + +**Recommendation:** +The most effective way to mitigate this risk is to implement rate limiting and abuse protection at the infrastructure or Web Application Firewall (WAF) layer. This approach allows thresholds to be tuned for each environment's expected usage and scaling characteristics. Some examples of controls can be: + +- Configuring a Web Application Firewall or API Gateway to enforce rate limits on sensitive operations, such as cluster creation and provisioning. +- Defining thresholds based on baseline workload expectations (e.g., max requests per minute per client). +- Monitoring logs and alerting on anomalies to detect potential abuse. +- Apply a resource quota, which is a Rancher feature that limits the resources available to a project or namespace. + +For more information, see: + +- [Project Resource Quotas](../../how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/manage-project-resource-quotas.md) +- [OWASP API Security Top 10 - API4:2019 - Lack of Resources & Rate Limiting](https://owasp.org/API-Security/editions/2023/en/0xa4-lack-of-resources-rate-limiting/) +- [OWASP Cheat Sheet: Rate Limiting](https://cheatsheetseries.owasp.org/cheatsheets/Rate_Limiting_Cheat_Sheet.html) \ No newline at end of file From 2922315ba08b41ce4f526d86af06936c7f12b043 Mon Sep 17 00:00:00 2001 From: Pietro Dell'Amore Date: Mon, 1 Sep 2025 10:26:19 -0300 Subject: [PATCH 4/5] Fix important section --- .../rancher-security/rancher-security-best-practices.md | 7 +++++-- .../rancher-security/rancher-security-best-practices.md | 7 +++++-- .../rancher-security/rancher-security-best-practices.md | 7 +++++-- .../rancher-security/rancher-security-best-practices.md | 7 +++++-- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md index 5b67aede622..9ffb4ca0978 100644 --- a/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.10/reference-guides/rancher-security/rancher-security-best-practices.md @@ -44,8 +44,11 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -> [!IMPORTANT] -> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) +:::note Important + +Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length). + +::: **Recommendation:** We strongly advice that customers: diff --git a/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md index 5b67aede622..9ffb4ca0978 100644 --- a/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.11/reference-guides/rancher-security/rancher-security-best-practices.md @@ -44,8 +44,11 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -> [!IMPORTANT] -> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) +:::note Important + +Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length). + +::: **Recommendation:** We strongly advice that customers: diff --git a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md index 5b67aede622..9ffb4ca0978 100644 --- a/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.12/reference-guides/rancher-security/rancher-security-best-practices.md @@ -44,8 +44,11 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -> [!IMPORTANT] -> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) +:::note Important + +Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length). + +::: **Recommendation:** We strongly advice that customers: diff --git a/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md b/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md index f68d6e965ef..1a8b6b1a39c 100644 --- a/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/versioned_docs/version-2.9/reference-guides/rancher-security/rancher-security-best-practices.md @@ -44,8 +44,11 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -> [!IMPORTANT] -> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) +:::note Important + +Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length). + +::: **Recommendation:** We strongly advice that customers: From eeac744361258f98a6f72c96f593066923a3e529 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 15 Sep 2025 08:11:03 -0700 Subject: [PATCH 5/5] Fix broken link --- .../rancher-security/rancher-security-best-practices.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md index 5b67aede622..9ffb4ca0978 100644 --- a/docs/reference-guides/rancher-security/rancher-security-best-practices.md +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -44,8 +44,11 @@ Examples of potential baseline policies include: Without these controls at the identity provider layer, there is a risk of inconsistent or insecure username practices, which can complicate access audits and lead to privilege escalation attempts. -> [!IMPORTANT] -> Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups#minimum-password-length.md) +:::note Important + +Rancher currently enforces only a [minimum password length](../../how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/manage-users-and-groups.md#minimum-password-length). + +::: **Recommendation:** We strongly advice that customers: