STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Only required ports must be open on containers in MKE.

DISA Rule

SV-260907r966078_rule

Vulnerability Number

V-260907

Group Title

SRG-APP-000142-CTR-000325

Rule Version

CNTR-MK-000640

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Document the ports required for each container in the SSP.

Fix the container image to expose only needed ports by the containerized application. Ignore the list of ports defined in the Dockerfile by NOT using -P (UPPERCASE) or --publish-all flag when starting the container. Use the -p (lowercase) or --publish flag to explicitly define the ports needed for a particular container instance.

Example:
docker run --interactive --tty --publish 5000 --publish 5001 --publish 5002 centos /bin/bash

Check Contents

This check must be executed on all nodes in an MKE cluster to ensure that mapped ports are the ones that are needed by the containers.

Via CLI:
Linux: As an administrator, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure the ports mapped are those needed for the container. If there are any mapped ports not documented by the System Security Plan (SSP), this is a finding.

Vulnerability Number

V-260907

Documentable

False

Rule Version

CNTR-MK-000640

Severity Override Guidance

This check must be executed on all nodes in an MKE cluster to ensure that mapped ports are the ones that are needed by the containers.

Via CLI:
Linux: As an administrator, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure the ports mapped are those needed for the container. If there are any mapped ports not documented by the System Security Plan (SSP), this is a finding.

Check Content Reference

M

Target Key

5595