mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-11-25 01:18:12 +00:00
2d033edc96
* Add files via upload * Add new cis support v1.20! * Fix issue with 1.1.9 and 1.1.10 tests Tests in some cases stat empty path which will return error. * Add tests for kubernetes 1.20 and retire 1.15 tests kubernetes 1.15 is not supported anymore and we shouldn't keep testing it. * Kubernetes 1.15 is not supported anymore * Tests for kubernetes 1.20 * Fix yamllint errors Removed trailing spaces (trailing-spaces) * Add tests for v1.20 * Remove extra spaces * Change cis test functions names
186 lines
12 KiB
Plaintext
186 lines
12 KiB
Plaintext
[INFO] 1 Master Node Security Configuration
|
|
[INFO] 1.1 Master Node Configuration Files
|
|
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)
|
|
[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)
|
|
[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)
|
|
[PASS] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)
|
|
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
|
|
[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)
|
|
[PASS] 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)
|
|
[PASS] 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)
|
|
[PASS] 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)
|
|
[INFO] 1.2 API Server
|
|
[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)
|
|
[PASS] 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)
|
|
[PASS] 1.2.3 Ensure that the --kubelet-https argument is set to true (Automated)
|
|
[PASS] 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)
|
|
[FAIL] 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)
|
|
[PASS] 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
|
|
[PASS] 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)
|
|
[PASS] 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)
|
|
[WARN] 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)
|
|
[PASS] 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)
|
|
[WARN] 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)
|
|
[WARN] 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)
|
|
[PASS] 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)
|
|
[PASS] 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)
|
|
[FAIL] 1.2.15 Ensure that the admission control plugin PodSecurityPolicy is set (Automated)
|
|
[PASS] 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)
|
|
[PASS] 1.2.17 Ensure that the --insecure-bind-address argument is not set (Automated)
|
|
[PASS] 1.2.18 Ensure that the --insecure-port argument is set to 0 (Automated)
|
|
[PASS] 1.2.19 Ensure that the --secure-port argument is not set to 0 (Automated)
|
|
[FAIL] 1.2.20 Ensure that the --profiling argument is set to false (Automated)
|
|
[FAIL] 1.2.21 Ensure that the --audit-log-path argument is set (Automated)
|
|
[FAIL] 1.2.22 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)
|
|
[FAIL] 1.2.23 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)
|
|
[FAIL] 1.2.24 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)
|
|
[WARN] 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated)
|
|
[PASS] 1.2.26 Ensure that the --service-account-lookup argument is set to true (Automated)
|
|
[PASS] 1.2.27 Ensure that the --service-account-key-file argument is set as appropriate (Automated)
|
|
[PASS] 1.2.28 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)
|
|
[PASS] 1.2.29 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)
|
|
[PASS] 1.2.30 Ensure that the --client-ca-file argument is set as appropriate (Automated)
|
|
[PASS] 1.2.31 Ensure that the --etcd-cafile argument is set as appropriate (Automated)
|
|
[WARN] 1.2.32 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)
|
|
[WARN] 1.2.33 Ensure that encryption providers are appropriately configured (Manual)
|
|
[WARN] 1.2.34 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)
|
|
[INFO] 1.3 Controller Manager
|
|
[WARN] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)
|
|
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Automated)
|
|
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)
|
|
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)
|
|
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)
|
|
[PASS] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)
|
|
[PASS] 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
|
|
[INFO] 1.4 Scheduler
|
|
[FAIL] 1.4.1 Ensure that the --profiling argument is set to false (Automated)
|
|
[PASS] 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
|
|
|
|
== Remediations master ==
|
|
1.1.9 Run the below command (based on the file location on your system) on the master node.
|
|
For example,
|
|
chmod 644 <path/to/cni/files>
|
|
|
|
1.1.10 Run the below command (based on the file location on your system) on the master node.
|
|
For example,
|
|
chown root:root <path/to/cni/files>
|
|
|
|
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
|
|
from the below command:
|
|
ps -ef | grep etcd
|
|
Run the below command (based on the etcd data directory found above).
|
|
For example, chown etcd:etcd /var/lib/etcd
|
|
|
|
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--anonymous-auth=false
|
|
|
|
1.2.5 Follow the Kubernetes documentation and setup the TLS connection between
|
|
the apiserver and kubelets. Then, edit the API server pod specification file
|
|
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
|
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
|
|
--kubelet-certificate-authority=<ca-string>
|
|
|
|
1.2.9 Follow the Kubernetes documentation and set the desired limits in a configuration file.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
and set the below parameters.
|
|
--enable-admission-plugins=...,EventRateLimit,...
|
|
--admission-control-config-file=<path/to/configuration/file>
|
|
|
|
1.2.11 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to include
|
|
AlwaysPullImages.
|
|
--enable-admission-plugins=...,AlwaysPullImages,...
|
|
|
|
1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to include
|
|
SecurityContextDeny, unless PodSecurityPolicy is already in place.
|
|
--enable-admission-plugins=...,SecurityContextDeny,...
|
|
|
|
1.2.15 Follow the documentation and create Pod Security Policy objects as per your environment.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to a
|
|
value that includes PodSecurityPolicy:
|
|
--enable-admission-plugins=...,PodSecurityPolicy,...
|
|
Then restart the API Server.
|
|
|
|
1.2.20 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-path parameter to a suitable path and
|
|
file where you would like audit logs to be written, for example:
|
|
--audit-log-path=/var/log/apiserver/audit.log
|
|
|
|
1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:
|
|
--audit-log-maxage=30
|
|
|
|
1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
|
|
value.
|
|
--audit-log-maxbackup=10
|
|
|
|
1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.
|
|
For example, to set it as 100 MB:
|
|
--audit-log-maxsize=100
|
|
|
|
1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
and set the below parameter as appropriate and if needed.
|
|
For example,
|
|
--request-timeout=300s
|
|
|
|
1.2.32 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>
|
|
|
|
1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
|
In this file, choose aescbc, kms or secretbox as the encryption provider.
|
|
|
|
1.2.34 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM
|
|
_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM
|
|
_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM
|
|
_SHA384
|
|
|
|
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,
|
|
for example:
|
|
--terminated-pod-gc-threshold=10
|
|
|
|
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
|
|
== Summary master ==
|
|
43 checks PASS
|
|
10 checks FAIL
|
|
11 checks WARN
|
|
0 checks INFO
|
|
|
|
== Summary total ==
|
|
43 checks PASS
|
|
10 checks FAIL
|
|
11 checks WARN
|
|
0 checks INFO
|