Ensure membership of the lxd group is limited to administrators

VisokaNivo 1Ručni pregledlxd

Opis

Members of the lxd group can talk to the LXD unix socket and therefore create privileged containers that mount the host filesystem; membership is equivalent to root. Group membership is site policy, so this is a review item.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Run "getent group lxd" and confirm every listed user is an authorised host administrator. Also review "lxc config trust list" for unexpected client certificates and enable restricted certificates or projects for non-admin users.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

gpasswd -d <user> lxd for unauthorised members; remove unexpected certificates with lxc config trust remove <fingerprint>; give limited users a restricted project (lxc config trust add --restricted --projects <p>).

Svojstva

Operativni sistemi: Bilo koji
Oznake: lxdcontainersaccess-control
Referenca: CIS-style LXD hardening guidance - Restrict access to the LXD socket (no CIS benchmark section; verify against your hardening standard)