STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Containers must not map to privileged ports.

DISA Rule

SV-260929r966144_rule

Vulnerability Number

V-260929

Group Title

SRG-APP-000142-CTR-000330

Rule Version

CNTR-MK-000650

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

To edit container ports, log in to the MKE web UI and navigate to Shared Resources >> Containers.

- Locate the container with the incorrect port mapping.
- Click on the container name and stop the container by clicking the three dots in the upper right corner.
- Scroll down to Ports and check if ports have been manually assigned.
- Edit the port to a nonprivileged port.

Check Contents

This check must be executed on all nodes in an MKE cluster.

Verify no running containers are mapping host port numbers below 1024.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.

Vulnerability Number

V-260929

Documentable

False

Rule Version

CNTR-MK-000650

Severity Override Guidance

This check must be executed on all nodes in an MKE cluster.

Verify no running containers are mapping host port numbers below 1024.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure container ports are not mapped to host port numbers below 1024. If they are, then this is a finding.

Check Content Reference

M

Target Key

5595