Ensure Docker is allowed to make changes to iptables

SrednjaNivo 1Automatskadocker

Opis

Docker must manage iptables so that container networking rules stay consistent with the daemon configuration. Compliant unless iptables is explicitly set to false. The audit reads the running dockerd command line (ps) together with /etc/docker/daemon.json.

Kako se proverava

Metod provere: Komanda ljuske

shell

args=$(ps -eo args 2>/dev/null) || exit 1; s=$(printf '%s\n' "$args" | grep '[d]ockerd'; cat /etc/docker/daemon.json 2>/dev/null); printf '%s\n' "$s" | grep -Eq -e '--iptables[= ]+false|"iptables"[[:space:]]*:[[:space:]]*false' && echo noncompliant || echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove "iptables": false from /etc/docker/daemon.json and --iptables=false from the dockerd start-up flags, then restart the Docker daemon.

Svojstva

Operativni sistemi: Bilo koji
Oznake: dockerdaemonnetwork
Referenca: CIS Docker Benchmark v1.9.0 - 2.4 Ensure Docker is allowed to make changes to iptables

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target docker