STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Incoming container traffic must be bound to a specific host interface.

DISA Rule

SV-260924r966129_rule

Vulnerability Number

V-260924

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000570

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

To edit container ports, log in to the MKE web UI and navigate to Shared Resources >> Containers.

- Locate the container with the incorrect port mapping.
- Click on the container name and stop the container by clicking on the three dots in the upper right hand corner.
- Scroll down to Ports to check if ports have been manually assigned.
- Edit the port to a nonprivileged port.

Check Contents

This check must be executed on all nodes in an MKE cluster.

Verify that no running containers are mapping host port numbers below 1024.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.

Ensure that there is no such container to host privileged port mapping declarations in the Mirantis config file. View the config file. If container to host privileged port mapping declarations exist, this is a finding.

Vulnerability Number

V-260924

Documentable

False

Rule Version

CNTR-MK-000570

Severity Override Guidance

This check must be executed on all nodes in an MKE cluster.

Verify that no running containers are mapping host port numbers below 1024.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.

Ensure that there is no such container to host privileged port mapping declarations in the Mirantis config file. View the config file. If container to host privileged port mapping declarations exist, this is a finding.

Check Content Reference

M

Target Key

5595