Ensure that all Docker swarm overlay networks are encrypted

MediaNivel 1Automatizadadocker

Descripción

Overlay network traffic between swarm nodes is unencrypted by default. On an active swarm node every overlay network must have the encrypted option; compliant when swarm mode is inactive.

Cómo se verifica

Método de auditoría: Comando de shell

shell

st=$(docker info --format '{{.Swarm.LocalNodeState}}') || exit 1; [ "$st" = active ] || { echo compliant; exit 0; }; ns=$(docker network ls --filter driver=overlay --quiet) || exit 1; [ -z "$ns" ] && { echo compliant; exit 0; }; out=$(docker network inspect --format '{{.Name}} {{index .Options "encrypted"}}' $ns) || exit 1; bad=$(printf '%s\n' "$out" | awk 'NF<2 {print $1}'); [ -z "$bad" ] && echo compliant || printf 'unencrypted overlay: %s\n' $bad

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create overlay networks with --opt encrypted (docker network create -d overlay --opt encrypted <name>) and move services onto them.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: dockerswarmnetwork
Referencia: CIS Docker Benchmark v1.9.0 - 7.3 Ensure that all Docker swarm overlay networks are encrypted

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target docker