arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-18 12:48:08 +00:00
Code Issues Releases Wiki Activity

fix: change the folder name for certificate files in rke-cis-1.7

Browse Source
This commit is contained in:
Abubakr-Sadik Nii Nai Davis 2024-12-09 05:16:04 +00:00 committed by GitHub
parent 64bc05354b
commit 20604a5f86
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
cfg/rke-cis-1.7/master.yaml
View File

@ -300,7 +300,7 @@ groups:
- id: 1.1.19 - id: 1.1.19
text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)" text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
audit: "check_files_owner_in_dir.sh /node/etc/kubernetes/ssl" audit: "check_files_owner_in_dir.sh /etc/kubernetes/ssl"
tests: tests:
test_items: test_items:
- flag: "true" - flag: "true"
@ -311,12 +311,12 @@ groups:
remediation: | remediation: |
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, For example,
chown -R root:root /etc/kubernetes/pki/ chown -R root:root /etc/kubernetes/ssl/
scored: true scored: true
- id: 1.1.20 - id: 1.1.20
text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)" text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
audit: "find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a" audit: "find /etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a"
use_multiple_values: true use_multiple_values: true
tests: tests:
test_items: test_items:
@ -327,12 +327,12 @@ groups:
remediation: | remediation: |
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, For example,
find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} + find /etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} +
scored: false scored: false
- id: 1.1.21 - id: 1.1.21
text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
audit: "find /node/etc/kubernetes/ssl/ -name '*key.pem' | xargs stat -c permissions=%a" audit: "find /etc/kubernetes/ssl/ -name '*key.pem' | xargs stat -c permissions=%a"
use_multiple_values: true use_multiple_values: true
tests: tests:
test_items: test_items:
@ -343,7 +343,7 @@ groups:
remediation: | remediation: |
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, For example,
find /node/etc/kubernetes/ssl/ -name '*key.pem' -exec chmod -R 600 {} + find /etc/kubernetes/ssl/ -name '*key.pem' -exec chmod -R 600 {} +
scored: false scored: false
- id: 1.2 - id: 1.2

4
cfg/rke-cis-1.7/node.yaml
View File

@ -98,7 +98,7 @@ groups:
- id: 4.1.7 - id: 4.1.7
text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)" text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"
audit: "stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem" audit: "stat -c permissions=%a /etc/kubernetes/ssl/kube-ca.pem"
tests: tests:
test_items: test_items:
- flag: "permissions" - flag: "permissions"
@ -112,7 +112,7 @@ groups:
- id: 4.1.8 - id: 4.1.8
text: "Ensure that the client certificate authorities file ownership is set to root:root (Automated)" text: "Ensure that the client certificate authorities file ownership is set to root:root (Automated)"
audit: "stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem" audit: "stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem"
tests: tests:
test_items: test_items:
- flag: root:root - flag: root:root