Detections
Analytics
CNTR-R2-000520 Configuration and authentication files for Rancher RKE2 must be protected.
Information
There are various configuration files, logs, access credentials, and other files stored on the host filesystem that contain sensitive information.These files could potentially put at risk, along with other specific workloads and components:
- API server.
- proxy.
- scheduler.
- controller.
- etcd.
- Kubernetes administrator account information.
- audit log access, modification, and deletion.
- application access, modification, and deletion.
- container runtime files.
If an attacker can gain access to these files, changes can be made to open vulnerabilities and bypass user authorizations inherent within Kubernetes with RBAC implemented. It is crucial to ensure user permissions are enforced down through to the operating system. Protecting file permissions will ensure that if a nonprivileged user gains access to the system they will still not be able to access protected information from the cluster API, cluster configuration, and sensitive cluster information. This control relies on the underlying operating system also having been properly configured to allow only least privileged access to perform required operations.
Satisfies: SRG-APP-000133-CTR-000300, SRG-APP-000133-CTR-000295, SRG-APP-000133-CTR-000305, SRG-APP-000133-CTR-000310
Solution
File system permissions:1. Fix permissions of the files in /etc/rancher/rke2:
cd /etc/rancher/rke2
chmod 0600 ./*
chown root:root ./*
ls -l
2. Fix permissions of the files in /var/lib/rancher/rke2:
cd /var/lib/rancher/rke2
chown root:root ./*
ls -l
3. Fix permissions of the files and directories in /var/lib/rancher/rke2/agent:
cd /var/lib/rancher/rke2/agent
chown root:root ./*
chmod 0700 pod-manifests
chmod 0700 etc
find . -maxdepth 1 -type f -name "*.kubeconfig" -exec chmod 0640 {} ;
find . -maxdepth 1 -type f -name "*.crt" -exec chmod 0600 {} ;
find . -maxdepth 1 -type f -name "*.key" -exec chmod 0600 {} ;
ls -l
4. Fix permissions of the files in /var/lib/rancher/rke2/bin:
cd /var/lib/rancher/rke2/agent/bin
chown root:root ./*
chmod 0750 ./*
ls -l
5. Fix permissions directory of /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2/agent
chown root:root data
chmod 0750 data
ls -l
6. Fix permissions of files in /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2/data
chown root:root ./*
chmod 0640 ./*
ls -l
7. Fix permissions in /var/lib/rancher/rke2/server:
cd /var/lib/rancher/rke2/server
chown root:root ./*
chmod 0700 cred
chmod 0700 db
chmod 0700 tls
chmod 0750 manifests
chmod 0750 logs
chmod 0600 token
ls -l
Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:
write-kubeconfig-mode: "0600"
Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server
See Also
Item Details
Audit Name: DISA Rancher Government Solutions RKE2 STIG v2r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-5(6), CAT|II, CCI|CCI-001499, Rule-ID|SV-254564r1016531_rule, STIG-ID|CNTR-R2-000520, Vuln-ID|V-254564
Plugin: Unix
Control ID: 94c68299c5638fdfc50dfd0657f3f486fcac3bb4c47c6c7ffad295af2f5a3115