mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-12-25 16:08:08 +00:00
e4d6ed2e8e
* Add example IAM policy * Pass RotateKubeletServerCertificate related checks if it's not found (#767) * Allow for environment variables to be checked in tests (#755) * Initial commit for checking environment variables for etcd * Revert config changes * Remove redundant struct data * Fix issues with failing tests * Initial changes based on code review * Add option to disable envTesting + Update docs * Initial tests * Finished testing * Fix broken tests * Add a total summary and always show all tests. (#759) Whether the total summary is shown can be specified with an option. Fixes #528 Signed-off-by: Christian Zunker <christian.zunker@codecentric.cloud> * Update Readme.md file with link to Contribution guide (#754) * Update License with the year and the owner name Please add this to make your license agreement strong * Updated Readme.md file with license and proper documentation links I have added a proper license agreement to the documentation. Also shortened the links to the issues so that it does not break in any on the forks. * Update LICENSE * Update README.md * Update README.md * Remove erroneous license info Co-authored-by: Liz Rice <liz@lizrice.com> * Support auto-detect platform when running on EKS or GKE (#683) * Support auto-detect platform when running on EKS or GKE * Change to get platform name from `kubectl version` * fix regexp and add test * Update Server Version match for EKS * try to get version info from api sever at first * Refactor group skip changed group 'skip' from being a bool to be 'type' string as done in check * Change skip: true -> type: skip Co-authored-by: Huang Huang <mozillazg101@gmail.com> Co-authored-by: Wicked <jason_attwood@hotmail.co.uk> Co-authored-by: Christian Zunker <827818+czunker@users.noreply.github.com> Co-authored-by: Kaiwalya Koparkar <kaiwalyakoparkar@gmail.com> Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
178 lines
11 KiB
Plaintext
178 lines
11 KiB
Plaintext
[INFO] 1 Master Node Security Configuration
|
|
[INFO] 1.1 Master Node Configuration Files
|
|
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
|
[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
|
[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
|
[PASS] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
|
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
|
[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
|
|
[PASS] 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Scored)
|
|
[PASS] 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Not Scored)
|
|
[PASS] 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Not Scored)
|
|
[INFO] 1.2 API Server
|
|
[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Not Scored)
|
|
[PASS] 1.2.2 Ensure that the --basic-auth-file argument is not set (Scored)
|
|
[PASS] 1.2.3 Ensure that the --token-auth-file parameter is not set (Scored)
|
|
[PASS] 1.2.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
|
[PASS] 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
|
[FAIL] 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
|
[PASS] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
|
[PASS] 1.2.8 Ensure that the --authorization-mode argument includes Node (Scored)
|
|
[PASS] 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
|
[WARN] 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Not Scored)
|
|
[PASS] 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Scored)
|
|
[WARN] 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)
|
|
[WARN] 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)
|
|
[PASS] 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Scored)
|
|
[PASS] 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
|
|
[FAIL] 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
|
[PASS] 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
|
[PASS] 1.2.18 Ensure that the --insecure-bind-address argument is not set (Scored)
|
|
[PASS] 1.2.19 Ensure that the --insecure-port argument is set to 0 (Scored)
|
|
[PASS] 1.2.20 Ensure that the --secure-port argument is not set to 0 (Scored)
|
|
[FAIL] 1.2.21 Ensure that the --profiling argument is set to false (Scored)
|
|
[FAIL] 1.2.22 Ensure that the --audit-log-path argument is set (Scored)
|
|
[FAIL] 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
|
[FAIL] 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
|
[FAIL] 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
|
[PASS] 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
|
[PASS] 1.2.27 Ensure that the --service-account-lookup argument is set to true (Scored)
|
|
[PASS] 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
|
[PASS] 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
|
[PASS] 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
|
[PASS] 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
|
[PASS] 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
|
[WARN] 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)
|
|
[WARN] 1.2.34 Ensure that encryption providers are appropriately configured (Not Scored)
|
|
[WARN] 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
|
[INFO] 1.3 Controller Manager
|
|
[WARN] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Not Scored)
|
|
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
|
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
|
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
|
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
|
[PASS] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
|
[PASS] 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
|
[INFO] 1.4 Scheduler
|
|
[FAIL] 1.4.1 Ensure that the --profiling argument is set to false (Scored)
|
|
[PASS] 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
|
|
|
== Remediations master ==
|
|
1.1.9 Run the below command (based on the file location on your system) on the master node.
|
|
For example,
|
|
chmod 644 <path/to/cni/files>
|
|
|
|
1.1.10 Run the below command (based on the file location on your system) on the master node.
|
|
For example,
|
|
chown root:root <path/to/cni/files>
|
|
|
|
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
|
|
from the below command:
|
|
ps -ef | grep etcd
|
|
Run the below command (based on the etcd data directory found above).
|
|
For example, chown etcd:etcd /var/lib/etcd
|
|
|
|
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--anonymous-auth=false
|
|
|
|
1.2.6 Follow the Kubernetes documentation and setup the TLS connection between
|
|
the apiserver and kubelets. Then, edit the API server pod specification file
|
|
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
|
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
|
|
--kubelet-certificate-authority=<ca-string>
|
|
|
|
1.2.10 Follow the Kubernetes documentation and set the desired limits in a configuration file.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
and set the below parameters.
|
|
--enable-admission-plugins=...,EventRateLimit,...
|
|
--admission-control-config-file=<path/to/configuration/file>
|
|
|
|
1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to include
|
|
AlwaysPullImages.
|
|
--enable-admission-plugins=...,AlwaysPullImages,...
|
|
|
|
1.2.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to include
|
|
SecurityContextDeny, unless PodSecurityPolicy is already in place.
|
|
--enable-admission-plugins=...,SecurityContextDeny,...
|
|
|
|
1.2.16 Follow the documentation and create Pod Security Policy objects as per your environment.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --enable-admission-plugins parameter to a
|
|
value that includes PodSecurityPolicy:
|
|
--enable-admission-plugins=...,PodSecurityPolicy,...
|
|
Then restart the API Server.
|
|
|
|
1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-path parameter to a suitable path and
|
|
file where you would like audit logs to be written, for example:
|
|
--audit-log-path=/var/log/apiserver/audit.log
|
|
|
|
1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:
|
|
--audit-log-maxage=30
|
|
|
|
1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
|
|
value.
|
|
--audit-log-maxbackup=10
|
|
|
|
1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.
|
|
For example, to set it as 100 MB:
|
|
--audit-log-maxsize=100
|
|
|
|
1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
|
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>
|
|
|
|
1.2.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
|
In this file, choose aescbc, kms or secretbox as the encryption provider.
|
|
|
|
1.2.35 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
on the master node and set the below parameter.
|
|
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
|
|
|
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,
|
|
for example:
|
|
--terminated-pod-gc-threshold=10
|
|
|
|
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
|
|
on the master node and set the below parameter.
|
|
--profiling=false
|
|
|
|
|
|
== Summary master ==
|
|
45 checks PASS
|
|
10 checks FAIL
|
|
10 checks WARN
|
|
0 checks INFO
|
|
|
|
== Summary total ==
|
|
45 checks PASS
|
|
10 checks FAIL
|
|
10 checks WARN
|
|
0 checks INFO |