Ensure that anonymous requests are authorized

CriticalLevel 1Manual reviewopenshift

Description

When anonymous requests to the API server are allowed, they must be authorized. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

OpenShift allows anonymous requests (then authorizes them). OpenShift allows anonymous requests to the API server to support information discovery and webhook integrations. OpenShift provides it's own fully integrated authentication and authorization mechanism. If no access token or certificate is presented, the authentication layer assigns the system:anonymous virtual user and the system:unauthenticated virtual group to the request. This allows the authorization layer to determine which requests, if any, an anonymous user is allowed to make.

How it is fixed

Fix method: Guidance or infrastructure patch

None. The default configuration should not be modified.

Properties

Operating systems: Any
Tags: openshiftapi-server
Reference: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.2.1 Ensure that anonymous requests are authorized