STIGQter STIGQter: STIG Summary: Rancher Government Solutions RKE2 Security Technical Implementation Guide Version: 2 Release: 7 Benchmark Date: 01 Jul 2026:

Configuration and authentication files for Rancher RKE2 must be protected.

DISA Rule

SV-254564r1156618_rule

Vulnerability Number

V-254564

Group Title

SRG-APP-000133-CTR-000300

Rule Version

CNTR-R2-000520

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

File system permissions:
1. Fix permissions of the files in /etc/rancher/rke2:
cd /etc/rancher/rke2
chmod 0600 ./*
chown root:root ./*
ls -l

2. Fix permissions of the files in /var/lib/rancher/rke2:
cd /var/lib/rancher/rke2
chown root:root ./*
ls -l

3. Fix permissions of the files and directories in /var/lib/rancher/rke2/agent:
cd /var/lib/rancher/rke2/agent
chown root:root ./*
chmod 0700 pod-manifests
chmod 0700 etc
find . -maxdepth 1 -type f -name "*.kubeconfig" -exec chmod 0640 {} \;
find . -maxdepth 1 -type f -name "*.crt" -exec chmod 0600 {} \;
find . -maxdepth 1 -type f -name "*.key" -exec chmod 0600 {} \;
ls -l

4. Fix permissions of the files in /var/lib/rancher/rke2/bin:
cd /var/lib/rancher/rke2/bin
chown root:root ./*
chmod 0750 ./*
ls -l

5. Fix permissions directory of /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2
chown root:root data
chmod 0750 data
ls -l

6. Fix permissions of files in /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2/data
chown root:root ./*
chmod 0750 ./*
ls -l

7. Fix permissions in /var/lib/rancher/rke2/server:
cd /var/lib/rancher/rke2/server
chown root:root ./*
chmod 0700 cred
chmod 0700 db
chmod 0700 tls
chmod 0750 manifests
chmod 0750 logs
chmod 0600 token
ls -l

Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

write-kubeconfig-mode: "0600"

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

Check Contents

File system permissions:
1. Verify correct permissions of the files in /etc/rancher/rke2.
cd /etc/rancher/rke2
ls -l

all owners are root:root
all permissions are 0600

2. Verify correct permissions of the files in /var/lib/rancher/rke2.
cd /var/lib/rancher/rke2
ls -l

all owners are root:root

3. Verify correct permissions of the files and directories in /var/lib/rancher/rke2/agent.
cd /var/lib/rancher/rke2/agent
ls -l

owners and group are root:root

File permissions set to at least 0640 for the following:
rke2controller.kubeconfig
kubelet.kubeconfig
kubeproxy.kubeconfig

Certificate file permissions set to 0600:
client-ca.crt
client-kubelet.crt
client-kube-proxy.crt
client-rke2-controller.crt
server-ca.crt
serving-kubelet.crt

Key file permissions set to 0600:
client-kubelet.key
serving-kubelet.key
client-rke2-controller.key
client-kube-proxy.key

The directory permissions to 0700:
pod-manifests
etc

4. Verify correct permissions of the files in /var/lib/rancher/rke2/bin.
cd /var/lib/rancher/rke2/bin
ls -l

all owners are root:root
all files are 0750

5. Verify correct permissions of the directory /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2
ls -l

owners are root:root
permissions are 0750

6. Verify correct permissions of each file in /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2/data
ls -l

all owners are root:root
all files are 0750

7. Verify correct permissions of /var/lib/rancher/rke2/server.
cd /var/lib/rancher/rke2/server
ls -l

all owners are root:root

The following directories are set to 0700:
cred
db
tls

The following directories are set to 0750:
manifests
logs

The following file is set to 0600:
token

8. Verify the RKE2 Server configuration file on all RKE2 Server hosts contain the following:
(cat /etc/rancher/rke2/config.yaml)
write-kubeconfig-mode: "0600"

If any of the permissions specified above do not match the required level, this is a finding.

Vulnerability Number

V-254564

Documentable

False

Rule Version

CNTR-R2-000520

Severity Override Guidance

File system permissions:
1. Verify correct permissions of the files in /etc/rancher/rke2.
cd /etc/rancher/rke2
ls -l

all owners are root:root
all permissions are 0600

2. Verify correct permissions of the files in /var/lib/rancher/rke2.
cd /var/lib/rancher/rke2
ls -l

all owners are root:root

3. Verify correct permissions of the files and directories in /var/lib/rancher/rke2/agent.
cd /var/lib/rancher/rke2/agent
ls -l

owners and group are root:root

File permissions set to at least 0640 for the following:
rke2controller.kubeconfig
kubelet.kubeconfig
kubeproxy.kubeconfig

Certificate file permissions set to 0600:
client-ca.crt
client-kubelet.crt
client-kube-proxy.crt
client-rke2-controller.crt
server-ca.crt
serving-kubelet.crt

Key file permissions set to 0600:
client-kubelet.key
serving-kubelet.key
client-rke2-controller.key
client-kube-proxy.key

The directory permissions to 0700:
pod-manifests
etc

4. Verify correct permissions of the files in /var/lib/rancher/rke2/bin.
cd /var/lib/rancher/rke2/bin
ls -l

all owners are root:root
all files are 0750

5. Verify correct permissions of the directory /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2
ls -l

owners are root:root
permissions are 0750

6. Verify correct permissions of each file in /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2/data
ls -l

all owners are root:root
all files are 0750

7. Verify correct permissions of /var/lib/rancher/rke2/server.
cd /var/lib/rancher/rke2/server
ls -l

all owners are root:root

The following directories are set to 0700:
cred
db
tls

The following directories are set to 0750:
manifests
logs

The following file is set to 0600:
token

8. Verify the RKE2 Server configuration file on all RKE2 Server hosts contain the following:
(cat /etc/rancher/rke2/config.yaml)
write-kubeconfig-mode: "0600"

If any of the permissions specified above do not match the required level, this is a finding.

Check Content Reference

M

Target Key

5486