STIGQter STIGQter: STIG Summary: Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Docker Enterprise network ports on all running containers must be limited to what is needed.

DISA Rule

SV-235837r627638_rule

Vulnerability Number

V-235837

Group Title

SRG-APP-000383

Rule Version

DKER-EE-003560

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Publish only needed ports for all container images and running containers per the requirements set forth by the SSP.

Update Dockerfiles and set or remove any EXPOSE lines accordingly.

To ignore exposed ports as defined by a Dockerfile during container start, do not pass the "-P/--publish-all" flag to the Docker commands.

When publishing needed ports at container start, use the "-p/--publish" flag to explicitly define the ports that are needed.

Check Contents

Verify that only needed ports are open on all running containers.

via CLI: As a Docker EE admin, execute the following command using a client bundle:

docker ps -q | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that the ports mapped are the ones really needed for the containers per the requirements set forth by the SSP.

If ports are not documented and approved in the SSP, this is a finding.

Vulnerability Number

V-235837

Documentable

False

Rule Version

DKER-EE-003560

Severity Override Guidance

Verify that only needed ports are open on all running containers.

via CLI: As a Docker EE admin, execute the following command using a client bundle:

docker ps -q | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that the ports mapped are the ones really needed for the containers per the requirements set forth by the SSP.

If ports are not documented and approved in the SSP, this is a finding.

Check Content Reference

M

Target Key

5281

Comments