Ensure that all Docker swarm overlay networks are encrypted

SedangLevel 1Otomatisdocker

Deskripsi

Overlay network traffic between swarm nodes is unencrypted by default. On an active swarm node every overlay network must have the encrypted option; compliant when swarm mode is inactive.

Cara pemeriksaan

Metode audit: Perintah shell

shell

st=$(docker info --format '{{.Swarm.LocalNodeState}}') || exit 1; [ "$st" = active ] || { echo compliant; exit 0; }; ns=$(docker network ls --filter driver=overlay --quiet) || exit 1; [ -z "$ns" ] && { echo compliant; exit 0; }; out=$(docker network inspect --format '{{.Name}} {{index .Options "encrypted"}}' $ns) || exit 1; bad=$(printf '%s\n' "$out" | awk 'NF<2 {print $1}'); [ -z "$bad" ] && echo compliant || printf 'unencrypted overlay: %s\n' $bad

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Create overlay networks with --opt encrypted (docker network create -d overlay --opt encrypted <name>) and move services onto them.

Properti

Sistem operasi: Apa saja
Tag: dockerswarmnetwork
Referensi: CIS Docker Benchmark v1.9.0 - 7.3 Ensure that all Docker swarm overlay networks are encrypted

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target docker