Ensure insecure registries are not used

VisokaNivo 1Automatskadocker

Opis

Insecure registries are contacted without TLS verification, exposing image pulls to tampering. The audit lists the registry index configs that docker info reports as not secure (the default loopback CIDRs are not listed) and expects none.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(docker info --format '{{range .RegistryConfig.IndexConfigs}}{{if not .Secure}}{{.Name}}{{"\n"}}{{end}}{{end}}') || exit 1; n=$(printf '%s\n' "$out" | grep -c . || true); echo "$n"

Očekivani izlaz: 0

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove entries from "insecure-registries" in /etc/docker/daemon.json (and --insecure-registry start-up flags), configure TLS on the registries, and restart the Docker daemon.

Svojstva

Operativni sistemi: Bilo koji
Oznake: dockerdaemonregistry
Referenca: CIS Docker Benchmark v1.9.0 - 2.5 Ensure insecure registries are not used

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target docker