arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-21 23:58:06 +00:00
Code Issues Releases Wiki Activity

Fix audit and remediation for CIS-1.9 master 1.1.13/1.1.14 (#1649)

Browse Source 
* Fix audit and remediation for CIS-1.9 master 1.1.13/1.1.14

* Fix loop syntax for file paths

---------

Co-authored-by: afdesk <work@afdesk.com>
This commit is contained in:
Andy Pitcher 2024-09-26 00:45:48 -04:00 committed by GitHub
parent a9422a6623
commit 2751f87034
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfg/cis-1.9/master.yaml
View File

@ -189,7 +189,7 @@ groups:
- id: 1.1.13
text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
audit: |
for adminconf in /etc/kubernetes/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c \"permissions=%a %n\" $adminconf; fi; done
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
use_multiple_values: true
tests:
test_items:
@ -207,7 +207,7 @@ groups:
- id: 1.1.14
text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
audit: |
for adminconf in /tmp/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
use_multiple_values: true
tests:
test_items:
@ -219,7 +219,7 @@ groups:
Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root /etc/kubernetes/admin.conf
On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
For example, chmod 600 /etc/kubernetes/super-admin.conf
For example, chown root:root /etc/kubernetes/super-admin.conf
scored: true
- id: 1.1.15