STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 13 Apr 2021:

Kubernetes must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures or the installation of patches and updates.

DISA Rule

SV-242435r712661_rule

Vulnerability Number

V-242435

Group Title

SRG-APP-000340-CTR-000770

Rule Version

CNTR-K8-001990

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-001812 - The information system prohibits user installation of software without explicit privileged status.
• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the argument "--authorization-mode" to any valid authorization mode other than AlwaysAllow.

Check Contents

Change to the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Run the command:

grep -i authorization-mode *

If the setting authorization-mode is set to "AlwaysAllow" in the Kubernetes API Server manifest file or is not configured, this is a finding.

Vulnerability Number

V-242435

Documentable

False

Rule Version

CNTR-K8-001990

Severity Override Guidance

Change to the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Run the command:

grep -i authorization-mode *

If the setting authorization-mode is set to "AlwaysAllow" in the Kubernetes API Server manifest file or is not configured, this is a finding.

Check Content Reference

M

Target Key

5376

Comments