Docker
TMA-DOCKER-7.5
Ensure that swarm manager is run in auto-lock mode
MediaNivel 1Automatizadadocker
Descripción
Auto-lock protects the swarm raft keys at rest so a stolen manager disk cannot be used without the unlock key. On an active swarm manager the cluster spec must have AutoLockManagers true; compliant on non-swarm hosts and workers.
Cómo se verifica
Método de auditoría: Comando de shell
shell
st=$(docker info --format '{{.Swarm.LocalNodeState}}') || exit 1; [ "$st" = active ] || { echo compliant; exit 0; }; m=$(docker info --format '{{.Swarm.ControlAvailable}}') || exit 1; [ "$m" = true ] || { echo compliant; exit 0; }; v=$(docker info --format '{{.Swarm.Cluster.Spec.EncryptionConfig.AutoLockManagers}}') || exit 1; [ "$v" = true ] && echo compliant || echo "autolock $v"- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
docker swarm update --autolock=true on a manager and store the unlock key securely.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- dockerswarm
- Referencia
- CIS Docker Benchmark v1.9.0 - 7.5 Ensure that swarm manager is run in auto-lock mode
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target docker