Ensure that the etcd data directory permissions are set to 700 or more restrictive

高级别 1自动化kubernetes

说明

Ensure that the etcd data directory has permissions of 700 or more restrictive. Runs on etcd/control-plane nodes; the data directory comes from etcd --data-dir (default /var/lib/etcd).

检查方式

审计方法: Shell 命令

shell

set -f
a=$(ps -eo args 2>/dev/null | grep -E '^([^ ]*/)?etcd( |$)' | head -n 1)
[ -n "$a" ] || a=$(cat /etc/kubernetes/manifests/etcd.yaml 2>/dev/null | tr '\n' ' ')
d=$(printf '%s\n' "$a" | tr ' "' '\n\n' | sed -n 's/^--data-dir=//p' | tail -n 1); d=${d:-/var/lib/etcd}
[ -d "$d" ] || exit 1
p=$(stat -Lc %a "$d") || exit 1
if [ $((0$p & 0077)) -eq 0 ]; then echo compliant; else echo "noncompliant: $d mode $p"; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

On the etcd server node, get the etcd data directory, passed as an argument --data-dir, from the below command: ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd

属性

操作系统: 任意
标签: kubernetescontrol-planeetcdfile-permissions
参考: CIS Kubernetes Benchmark v2.1.0 - 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target kubernetes