TMA-DOCKER-2.14
Ensure centralized and remote logging is configured
SrednjaNivo 2Automatskadocker
Opis
Centralized logging keeps container logs off the host where they can be tampered with. The audit reads the default logging driver from docker info and fails for the local-only drivers json-file, local and none.
Kako se proverava
Metod provere: Komanda ljuske
shell
d=$(docker info --format '{{.LoggingDriver}}') || exit 1; case "$d" in json-file|local|none|'') echo "local:$d";; *) echo compliant;; esac- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Set "log-driver" (e.g. syslog, journald forwarded to a collector, fluentd, gelf, splunk) and its "log-opts" in /etc/docker/daemon.json, then restart the Docker daemon.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- dockerdaemonlogging
- Referenca
- CIS Docker Benchmark v1.9.0 - 2.14 Ensure centralized and remote logging is configured
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
shell
tmaegis scan --target docker --level 2