Detections
Analytics
DKER-EE-001870 - The Docker Enterprise self-signed certificates in Universal Control Plane (UCP) must be replaced with DoD trusted, signed certificates.
Information
Docker Enterprise includes the following capabilities that are considered non-essential:*NOTE: disabling these capabilities negatively affects the operation of Docker Trusted Registry (DTR) and should be disregarded when UCP and DTR are installed. The security capabilities provided by UCP and DTR offset any potential vulnerabilities associated with not disabling these essential capabilities the Engine provides.
(Docker Engine - Enterprise: Standalone) - The majority of these items were originally identified as part of the CIS Docker Benchmark, which as of the CIS Docker Benchmark v1.2.0, are still applicable to Docker Engine - Enterprise 18.09
- inter-container communication (icc)* (CIS Docker Benchmark Recommendation 2.1)
- insecure registry communication (CIS Docker Benchmark Recommendation 2.4)
- AUFS storage driver (applicable on Linux only) (CIS Docker Benchmark Recommendation 2.5)
- listening on the TCP Daemon socket
- userland proxy for loopback traffic* (CIS Docker Benchmark Recommendation 2.15)
- experimental features (CIS Docker Benchmark Recommendation 2.17)
- Swarm Mode (CIS Docker Benchmark Recommendation 7.1)
(Docker Engine - Enterprise: As part of a UCP cluster)
- insecure registry communication (CIS Docker Benchmark Recommendation 2.4)
- AUFS storage driver (applicable on Linux only) (CIS Docker Benchmark Recommendation 2.5)
- listening on the TCP Daemon socket
- experimental features (CIS Docker Benchmark Recommendation 2.17)
(UCP)
- Managed user database
- self-signed certificates
- periodic usage reporting and API tracking
- allow users and administrators to schedule containers on all nodes, including UCP managers and DTR nodes
(DTR)
- periodic data usage/analytics reporting
- create repository on push
- self-signed certificates
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
This fix only applies to the UCP component of Docker Enterprise.Integrate UCP with a trusted certificate authority CA.
via UI:
In the UCP web console, navigate to 'Admin Settings' | 'Certificates'. Fill in (or click on the 'Upload' links) the 'CA Certificate' field with the contents of the external public CA certificate. Assuming the user generated a server certificate from that CA for UCP, also fill in the 'Server Certificate' and 'Private Key' fields with the contents of the public/private certificates respectively. The 'Server Certificate' field must include both the UCP server certificate and any intermediate certificates. Click on the 'Save' button.
If DTR was previously integrated with this UCP cluster, execute a 'dtr reconfigure' command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.
via CLI:
Linux: As a superuser, execute the following commands on each UCP Manager node in the cluster and in the directory where keys and certificates are located:
Create a container that attaches to the same volume where certificates are stored:
docker create --name replace-certs -v ucp-controller-server-certs:/data busybox
Copy keys and certificates to the container's volumes:
docker cp cert.pem replace-certs:/data/cert.pem
docker cp ca.pem replace-certs:/data/ca.pem
docker cp key.pem replace-certs:/data/key.pem
Remove the container, since it is no longer needed:
docker rm replace-certs
Restart the container, since it is no longer needed:
docker rm replace-certs
Restart the ucp-controller container:
docker restart ucp-controller
If DTR was previously integrated with this UCP cluster, execute a 'dtr reconfigure' command as a superuser on one of the UCP Manager nodes in the cluster to re-configure DTR with the updated UCP certificates.
See Also
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-235793r960963_rule, STIG-ID|DKER-EE-001870, STIG-Legacy|SV-104757, STIG-Legacy|V-95619, Vuln-ID|V-235793
Plugin: Unix
Control ID: c67ae77f639faa82381a1ab518419e1d39f0f63128288f444725bcaab0fbcac2