TMA-KUBERNETES-4.2.1

Ensure that the --anonymous-auth argument is set to false

严重级别 1自动化kubernetes

说明

Disable anonymous requests to the Kubelet server. Runs on each node: a kubelet command-line flag takes precedence over the config file named by --config (default /var/lib/kubelet/config.yaml), otherwise the kubelet default applies.

检查方式

审计方法: Shell 命令

shell

set -f
psarg() { ps -eo args 2>/dev/null | grep -E "^([^ ]*/)?$1( |\$)" | head -n 1 | awk -v k="--$2" '{for(i=1;i<=NF;i++){if($i==k&&i<NF)v=$(i+1); else if(index($i,k"=")==1)v=substr($i,length(k)+2)}} END{if(v!="")print v}'; }
cfg=$(psarg kubelet config); cfg=${cfg:-${kubelet_config_yaml:-/var/lib/kubelet/config.yaml}}
y() { [ -r "$cfg" ] || return 0; awk -v want="$1" '{sub(/\r$/,"")} /^[ \t]*(#|$)/{next} /^[ \t]*-/{next} {match($0,/^ */); ind=RLENGTH; line=substr($0,ind+1); c=index(line,":"); if(c==0)next; k=substr(line,1,c-1); gsub(/"/,"",k); val=substr(line,c+1); sub(/^[ \t]+/,"",val); sub(/[ \t]+#.*$/,"",val); sub(/[ \t]+$/,"",val); gsub(/"/,"",val); while(n>0 && ind<=ids[n]) n--; n++; ids[n]=ind; keys[n]=k; p=keys[1]; for(i=2;i<=n;i++) p=p "." keys[i]; if(p==want && val!=""){print val; exit}}' "$cfg"; }
v=$(psarg kubelet anonymous-auth); [ -n "$v" ] || v=$(y authentication.anonymous.enabled); v=${v:-true}
if [ "$v" = "false" ]; then echo compliant; else echo "noncompliant: authentication.anonymous.enabled=$v"; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --anonymous-auth=false Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service

属性

操作系统: 任意
标签: kubernetesworker-node
参考: CIS Kubernetes Benchmark v2.1.0 - 4.2.1 Ensure that the --anonymous-auth argument is set to false

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target kubernetes