diff --git a/docs/pages-for-subheaders/rancher-security.md b/docs/pages-for-subheaders/rancher-security.md index 5a30b09c77b..4426fb66c60 100644 --- a/docs/pages-for-subheaders/rancher-security.md +++ b/docs/pages-for-subheaders/rancher-security.md @@ -87,3 +87,7 @@ Rancher is committed to informing the community of security issues in our produc ### Kubernetes Security Best Practices For recommendations on securing your Kubernetes cluster, refer to the [Kubernetes Security Best Practices](../reference-guides/rancher-security/kubernetes-security-best-practices.md) guide. + +### Rancher Security Best Practices + +For recommendations on securing your Rancher, refer to the [Rancher Security Best Practices](../reference-guides/rancher-security/rancher-security-best-practices.md) guide. diff --git a/docs/reference-guides/rancher-security/rancher-security-best-practices.md b/docs/reference-guides/rancher-security/rancher-security-best-practices.md new file mode 100644 index 00000000000..55122d9a8a7 --- /dev/null +++ b/docs/reference-guides/rancher-security/rancher-security-best-practices.md @@ -0,0 +1,13 @@ +--- +title: Rancher Security Best Practices +--- + + + + + +### Restricting public access to /version path + +It is well-known that attackers might want to gather any information related to services running online. When running a Rancher server, the `/version` path can disclose some information about the server. We know that this path can be commonly used to monitor uptime from the service or any other monitoring metrics. In this case, we recommend customers block the `/version` path at the infrastructure level, through Firewall rules, keeping it accessible only for monitoring tools or intranet. + +Further references: OWASP Web Application Security Testing - [Enumerate Infrastructure and Application Admin Interfaces](https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/05-Enumerate_Infrastructure_and_Application_Admin_Interfaces.html).