TMA-DOCKER-3.14

Ensure that the Docker server certificate key file permissions are set to 400

TinggiLevel 1Otomatisdocker

Deskripsi

The Docker server certificate key file must have mode 400 or more restrictive. The path is taken from --tlskey on the dockerd command line or "tlskey" in /etc/docker/daemon.json (default /root/.docker/key.pem); compliant when no such file exists (TLS not configured).

Cara pemeriksaan

Metode audit: Perintah shell

shell

args=$(ps -eo args 2>/dev/null) || exit 1; s=$(printf '%s\n' "$args" | grep '[d]ockerd'; cat /etc/docker/daemon.json 2>/dev/null); p=$(printf '%s\n' "$s" | sed -n -e 's/.*--tlskey[= ]\([^ ]*\).*/\1/p' -e 's/.*"tlskey"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1); [ -n "$p" ] || p=/root/.docker/key.pem; [ -e "$p" ] || { echo compliant; exit 0; }; out=$(find "$p" -maxdepth 0 -perm /7377) || exit 1; [ -z "$out" ] && echo compliant || echo "$p"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

chmod 400 <path of the tlskey file> (as configured for dockerd).

Properti

Sistem operasi: Apa saja
Tag: dockerpermissionstls
Referensi: CIS Docker Benchmark v1.9.0 - 3.14 Ensure that the Docker server certificate key file permissions are set to 400

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target docker