STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

FIPS mode must be enabled.

DISA Rule

SV-260908r966081_rule

Vulnerability Number

V-260908

Group Title

SRG-APP-000172-CTR-000440

Rule Version

CNTR-MK-000870

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

If the operating system has FIPS enabled, FIPS mode is enabled by default in MCR. The preferred method is to ensure FIPS mode is set on the operating system prior to installation.

If a change is required on a deployed system, create the directory if it does not exist by executing the following:

mkdir -p /etc/systemd/system/docker.service.d/

Create a file called /etc/systemd/system/docker.service.d/fips-module.conf and add the following:

[Service]
Environment="DOCKER_FIPS=1"

Reload the Docker configuration to systemd by executing the following:

sudo systemctl daemon-reload

Restart the Docker service by executing the following:

sudo systemctl restart docker

Check Contents

On the MKE controller, verify FIPS mode is enabled.

Execute the following command through the CLI:

docker info

The "Security Options" section in the response must show a "fips" label, indicating that, when configured, the remotely accessible MKE UI uses FIPS-validated digital signatures in conjunction with an approved hash function to protect the integrity of remote access sessions.

If the "fips" label is not shown in the "Security Options" section, then this is a finding.

Vulnerability Number

V-260908

Documentable

False

Rule Version

CNTR-MK-000870

Severity Override Guidance

On the MKE controller, verify FIPS mode is enabled.

Execute the following command through the CLI:

docker info

The "Security Options" section in the response must show a "fips" label, indicating that, when configured, the remotely accessible MKE UI uses FIPS-validated digital signatures in conjunction with an approved hash function to protect the integrity of remote access sessions.

If the "fips" label is not shown in the "Security Options" section, then this is a finding.

Check Content Reference

M

Target Key

5595