arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-22 08:08:07 +00:00
Code Issues Releases Wiki Activity

Fix audit and remediation for CIS-1.9 master 1.1.13/1.1.14 (#1649)

Browse Source 
* Fix audit and remediation for CIS-1.9 master 1.1.13/1.1.14

* Fix loop syntax for file paths

---------

Co-authored-by: afdesk <work@afdesk.com>
This commit is contained in:
Andy Pitcher 2024-09-26 00:45:48 -04:00 committed by GitHub
parent a9422a6623
commit 2751f87034
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfg/cis-1.9/master.yaml
View File

@ -189,7 +189,7 @@ groups:
- id: 1.1.13 - id: 1.1.13
text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)" text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
audit: | audit: |
for adminconf in /etc/kubernetes/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c \"permissions=%a %n\" $adminconf; fi; done for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
use_multiple_values: true use_multiple_values: true
tests: tests:
test_items: test_items:
@ -207,7 +207,7 @@ groups:
- id: 1.1.14 - id: 1.1.14
text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)" text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
audit: | audit: |
for adminconf in /tmp/{admin.conf,super-admin.conf}; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
use_multiple_values: true use_multiple_values: true
tests: tests:
test_items: test_items:
@ -219,7 +219,7 @@ groups:
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, chown root:root /etc/kubernetes/admin.conf For example, chown root:root /etc/kubernetes/admin.conf
On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present. On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
For example, chmod 600 /etc/kubernetes/super-admin.conf For example, chown root:root /etc/kubernetes/super-admin.conf
scored: true scored: true
- id: 1.1.15 - id: 1.1.15