STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

SSH must not run within Linux containers.

DISA Rule

SV-260910r966087_rule

Vulnerability Number

V-260910

Group Title

SRG-APP-000033-CTR-000095

Rule Version

CNTR-MK-000120

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Containers found with SSH server must be removed by executing the following:

docker rm [container name]

Then, a new image must be added with SSH server removed.

Check Contents

This check must be executed on all nodes in a Docker Enterprise cluster.

Verify no running containers have a process for SSH server. Using CLI, execute the following:

for i in $(docker container ls --format "{{.ID}}"); do
pid=$(docker inspect -f '{{.State.Pid}}' "$i")
ps -h --ppid "$pid" -o cmd
done | grep sshd

If a container is output, it has a process for SSH server, this is a finding.

Vulnerability Number

V-260910

Documentable

False

Rule Version

CNTR-MK-000120

Severity Override Guidance

This check must be executed on all nodes in a Docker Enterprise cluster.

Verify no running containers have a process for SSH server. Using CLI, execute the following:

for i in $(docker container ls --format "{{.ID}}"); do
pid=$(docker inspect -f '{{.State.Pid}}' "$i")
ps -h --ppid "$pid" -o cmd
done | grep sshd

If a container is output, it has a process for SSH server, this is a finding.

Check Content Reference

M

Target Key

5595