From 3cafe284dd53ffafd332bc76b68f89b3e0f64b91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Thu, 14 Apr 2016 22:25:11 +0200 Subject: [PATCH] update chap 2 to cis 1.11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- tests/2_docker_daemon_configuration.sh | 127 +++++++++++++++---------- 1 file changed, 76 insertions(+), 51 deletions(-) diff --git a/tests/2_docker_daemon_configuration.sh b/tests/2_docker_daemon_configuration.sh index f0fc82f..3822b62 100644 --- a/tests/2_docker_daemon_configuration.sh +++ b/tests/2_docker_daemon_configuration.sh @@ -4,26 +4,26 @@ logit "\n" info "2 - Docker Daemon Configuration" # 2.1 -check_2_1="2.1 - Do not use lxc execution driver" -get_command_line_args docker | grep lxc >/dev/null 2>&1 +check_2_1="2.1 - Restrict network traffic between containers" +get_docker_effective_command_line_args '--icc' | grep "false" >/dev/null 2>&1 if [ $? -eq 0 ]; then - warn "$check_2_1" -else pass "$check_2_1" +else + warn "$check_2_1" fi # 2.2 -check_2_2="2.2 - Restrict network traffic between containers" -get_docker_effective_command_line_args '--icc' | grep "false" >/dev/null 2>&1 +check_2_2="2.2 - Set the logging level" +get_docker_effective_command_line_args '-l' | grep "debug" >/dev/null 2>&1 if [ $? -eq 0 ]; then - pass "$check_2_2" -else warn "$check_2_2" +else + pass "$check_2_2" fi # 2.3 -check_2_3="2.3 - Set the logging level" -get_docker_effective_command_line_args '-l' | grep "debug" >/dev/null 2>&1 +check_2_3="2.3 - Allow Docker to make changes to iptables" +get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_3" else @@ -31,8 +31,8 @@ else fi # 2.4 -check_2_4="2.4 - Allow Docker to make changes to iptables" -get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1 +check_2_4="2.4 - Do not use insecure registries" +get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_4" else @@ -40,8 +40,8 @@ else fi # 2.5 -check_2_5="2.5 - Do not use insecure registries" -get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1 +check_2_5="2.5 - Do not use the aufs storage driver" +docker info 2>/dev/null | grep -e "^Storage Driver:\s*aufs\s*$" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_5" else @@ -49,58 +49,83 @@ else fi # 2.6 -check_2_6="2.6 - Setup a local registry mirror" -get_docker_effective_command_line_args '--registry-mirror' | grep "registry-mirror" >/dev/null 2>&1 -if [ $? -eq 0 ]; then - pass "$check_2_6" -else - info "$check_2_6" - info " * No local registry currently configured" -fi - -# 2.7 -check_2_7="2.7 - Do not use the aufs storage driver" -docker info 2>/dev/null | grep -e "^Storage Driver:\s*aufs\s*$" >/dev/null 2>&1 -if [ $? -eq 0 ]; then - warn "$check_2_7" -else - pass "$check_2_7" -fi - -# 2.8 -check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" -get_docker_effective_command_line_args '-H' | grep "\-H" >/dev/null 2>&1 -if [ $? -eq 0 ]; then - info "$check_2_8" - info " * Docker daemon running with -H" -else - pass "$check_2_8" -fi - -# 2.9 -check_2_9="2.9 - Configure TLS authentication for Docker daemon" +check_2_6="2.6 - Configure TLS authentication for Docker daemon" get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1 if [ $? -eq 0 ]; then get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 if [ $? -eq 0 ]; then - pass "$check_2_9" + pass "$check_2_6" info " * Docker daemon currently listening on TCP" else - warn "$check_2_9" + warn "$check_2_6" warn " * Docker daemon currently listening on TCP without --tlsverify" fi else - info "$check_2_9" + info "$check_2_6" info " * Docker daemon not listening on TCP" fi -# 2.10 -check_2_10="2.10 - Set default ulimit as appropriate" +# 2.7 +check_2_7="2.7 - Set default ulimit as appropriate" get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1 if [ $? -eq 0 ]; then - pass "$check_2_10" + pass "$check_2_7" else - info "$check_2_10" + info "$check_2_7" info " * Default ulimit doesn't appear to be set" fi +# 2.8 +check_2_8="2.8 - Enable user namespace support" +get_docker_effective_command_line_args '--userns-remap' | grep "userns-remap" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + pass "$check_2_8" +else + warn "$check_2_8" +fi + +# 2.9 +check_2_9="2.9 - Confirm default cgroup usage" +get_docker_effective_command_line_args '--cgroup-parent' | grep "cgroup-parent" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + info "$check_2_9" + info " * Confirm cgroup usage" +else + pass "$check_2_9" +fi + +# 2.10 +check_2_10="2.10 - Do not change base device size until needed" +get_docker_effective_command_line_args '--storage-opt' | grep "dm.basesize" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + warn "$check_2_10" +else + pass "$check_2_10" +fi + +# 2.11 +check_2_11="2.11 - Use authorization plugin" +get_docker_effective_command_line_args '--authorization-plugin' | grep "authorization-plugin" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + pass "$check_2_11" +else + warn "$check_2_11" +fi + +# 2.12 +check_2_12="2.12 - Configure centralized and remote logging" +get_docker_effective_command_line_args '--log-driver' | grep "log-driver" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + pass "$check_2_12" +else + warn "$check_2_12" +fi + +# 2.13 +check_2_13="2.13 - Disable operations on legacy registry (v1)" +get_docker_effective_command_line_args '--disable-legacy-registry' | grep "disable-legacy-registry" >/dev/null 2>&1 +if [ $? -eq 0 ]; then + pass "$check_2_13" +else + warn "$check_2_13" +fi