Ensure that the Docker server certificate key file permissions are set to 400

HighLevel 1Automateddocker

Description

The Docker server certificate key file must have mode 400 or more restrictive. The path is taken from --tlskey on the dockerd command line or "tlskey" in /etc/docker/daemon.json (default /root/.docker/key.pem); compliant when no such file exists (TLS not configured).

How it is checked

Audit method: Shell command

shell

args=$(ps -eo args 2>/dev/null) || exit 1; s=$(printf '%s\n' "$args" | grep '[d]ockerd'; cat /etc/docker/daemon.json 2>/dev/null); p=$(printf '%s\n' "$s" | sed -n -e 's/.*--tlskey[= ]\([^ ]*\).*/\1/p' -e 's/.*"tlskey"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1); [ -n "$p" ] || p=/root/.docker/key.pem; [ -e "$p" ] || { echo compliant; exit 0; }; out=$(find "$p" -maxdepth 0 -perm /7377) || exit 1; [ -z "$out" ] && echo compliant || echo "$p"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

chmod 400 <path of the tlskey file> (as configured for dockerd).

Properties

Operating systems: Any
Tags: dockerpermissionstls
Reference: CIS Docker Benchmark v1.9.0 - 3.14 Ensure that the Docker server certificate key file permissions are set to 400

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker