TMA-DOCKER-2.5

Ensure insecure registries are not used

TinggiLevel 1Otomatisdocker

Deskripsi

Insecure registries are contacted without TLS verification, exposing image pulls to tampering. The audit lists the registry index configs that docker info reports as not secure (the default loopback CIDRs are not listed) and expects none.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(docker info --format '{{range .RegistryConfig.IndexConfigs}}{{if not .Secure}}{{.Name}}{{"\n"}}{{end}}{{end}}') || exit 1; n=$(printf '%s\n' "$out" | grep -c . || true); echo "$n"

Output yang diharapkan: 0

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remove entries from "insecure-registries" in /etc/docker/daemon.json (and --insecure-registry start-up flags), configure TLS on the registries, and restart the Docker daemon.

Properti

Sistem operasi: Apa saja
Tag: dockerdaemonregistry
Referensi: CIS Docker Benchmark v1.9.0 - 2.5 Ensure insecure registries are not used

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target docker