Ensure that the Docker server certificate file permissions are set to 444 or more restrictively

VisokaNivo 1Automatskadocker

Opis

The Docker server certificate file must have mode 444 or more restrictive. The path is taken from --tlscert on the dockerd command line or "tlscert" in /etc/docker/daemon.json (default /root/.docker/cert.pem); compliant when no such file exists (TLS not configured).

Kako se proverava

Metod provere: Komanda ljuske

shell

args=$(ps -eo args 2>/dev/null) || exit 1; s=$(printf '%s\n' "$args" | grep '[d]ockerd'; cat /etc/docker/daemon.json 2>/dev/null); p=$(printf '%s\n' "$s" | sed -n -e 's/.*--tlscert[= ]\([^ ]*\).*/\1/p' -e 's/.*"tlscert"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1); [ -n "$p" ] || p=/root/.docker/cert.pem; [ -e "$p" ] || { echo compliant; exit 0; }; out=$(find "$p" -maxdepth 0 -perm /7333) || exit 1; [ -z "$out" ] && echo compliant || echo "$p"

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

chmod 444 <path of the tlscert file> (as configured for dockerd).

Svojstva

Operativni sistemi: Bilo koji
Oznake: dockerpermissionstls
Referenca: CIS Docker Benchmark v1.9.0 - 3.12 Ensure that the Docker server certificate file permissions are set to 444 or more restrictively

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target docker