GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2024-11-01 00:21:45 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #546 from martipoe/master

Browse source 
Update check ID and add check groups for CIS Controls v8 (v1.6.0 - 06-14-2023)
This commit is contained in:
Thomas Sjögren 2023-12-20 15:41:02 +01:00 committed by GitHub
commit ba0b402ea5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 361 additions and 110 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

253
functions/functions_lib.sh
View file

@ -180,6 +180,7 @@ container_runtime() {
check_5_29
check_5_30
check_5_31
check_5_32
check_5_end
}
@ -213,7 +214,6 @@ docker_swarm_configuration() {
check_7_7
check_7_8
check_7_9
check_7_10
check_7_end
}
@ -307,6 +307,257 @@ cis_level1() {
docker_swarm_configuration_level1
}
cis_controls_v8_ig1() {
check_1_1_2
check_1_1_3
check_2_1
check_2_13
check_2_14
check_3_1
check_3_2
check_3_3
check_3_4
check_3_5
check_3_6
check_3_7
check_3_8
check_3_9
check_3_10
check_3_11
check_3_12
check_3_13
check_3_14
check_3_15
check_3_16
check_3_17
check_3_18
check_3_19
check_3_20
check_3_21
check_3_22
check_3_23
check_3_24
check_4_8
check_4_11
check_5_5
check_5_14
check_5_18
check_5_22
check_5_23
check_5_24
check_5_25
check_5_26
check_5_32
check_7_2
check_7_6
check_7_7
check_7_8
}
cis_controls_v8_ig2() {
check_1_1_1
check_1_1_2
check_1_1_3
check_1_1_4
check_1_1_5
check_1_1_6
check_1_1_7
check_1_1_8
check_1_1_9
check_1_1_10
check_1_1_11
check_1_1_12
check_1_1_13
check_1_1_14
check_1_1_15
check_1_1_16
check_1_1_17
check_1_1_18
check_1_2_1
check_1_2_2
check_2_1
check_2_2
check_2_3
check_2_4
check_2_5
check_2_7
check_2_8
check_2_11
check_2_13
check_2_14
check_2_15
check_2_16
check_2_18
check_3_1
check_3_2
check_3_3
check_3_4
check_3_5
check_3_6
check_3_7
check_3_8
check_3_9
check_3_10
check_3_11
check_3_12
check_3_13
check_3_14
check_3_15
check_3_16
check_3_17
check_3_18
check_3_19
check_3_20
check_3_21
check_3_22
check_3_23
check_3_24
check_4_2
check_4_3
check_4_4
check_4_7
check_4_8
check_4_9
check_4_11
check_5_1
check_5_2
check_5_3
check_5_4
check_5_5
check_5_7
check_5_10
check_5_11
check_5_12
check_5_14
check_5_16
check_5_17
check_5_18
check_5_19
check_5_21
check_5_22
check_5_23
check_5_24
check_5_25
check_5_26
check_5_27
check_5_30
check_5_31
check_5_32
check_6_1
check_6_2
check_7_2
check_7_3
check_7_5
check_7_6
check_7_7
check_7_8
check_7_9
}
cis_controls_v8_ig3() {
check_1_1_1
check_1_1_2
check_1_1_3
check_1_1_4
check_1_1_5
check_1_1_6
check_1_1_7
check_1_1_8
check_1_1_9
check_1_1_10
check_1_1_11
check_1_1_12
check_1_1_13
check_1_1_14
check_1_1_15
check_1_1_16
check_1_1_17
check_1_1_18
check_1_2_1
check_1_2_2
check_2_1
check_2_2
check_2_3
check_2_4
check_2_5
check_2_7
check_2_8
check_2_11
check_2_13
check_2_14
check_2_15
check_2_16
check_2_18
check_3_1
check_3_2
check_3_3
check_3_4
check_3_5
check_3_6
check_3_7
check_3_8
check_3_9
check_3_10
check_3_11
check_3_12
check_3_13
check_3_14
check_3_15
check_3_16
check_3_17
check_3_18
check_3_19
check_3_20
check_3_21
check_3_22
check_3_23
check_3_24
check_4_2
check_4_3
check_4_4
check_4_6
check_4_7
check_4_8
check_4_9
check_4_11
check_4_12
check_5_1
check_5_2
check_5_3
check_5_4
check_5_5
check_5_7
check_5_8
check_5_9
check_5_10
check_5_11
check_5_12
check_5_14
check_5_16
check_5_17
check_5_18
check_5_19
check_5_21
check_5_22
check_5_23
check_5_24
check_5_25
check_5_26
check_5_27
check_5_30
check_5_31
check_5_32
check_6_1
check_6_2
check_7_2
check_7_3
check_7_5
check_7_6
check_7_7
check_7_8
check_7_9
}
# Community contributed
community() {
community_checks

169
tests/5_container_runtime.sh
View file

@ -21,11 +21,28 @@ check_running_containers() {
}
check_5_1() {
local id="5.1"
local desc="Ensure swarm mode is not Enabled, if not needed (Automated)"
local remediation="If swarm mode has been enabled on a system in error, you should run the command: docker swarm leave"
local remediationImpact="Disabling swarm mode will impact the operation of Docker Enterprise components if these are in use."
local check="$id - $desc"
starttestjson "$id" "$desc"
if docker info 2>/dev/null | grep -e "Swarm:*\sinactive\s*" >/dev/null 2>&1; then
pass -s "$check"
logcheckresult "PASS"
return
fi
warn -s "$check"
logcheckresult "WARN"
}
check_5_2() {
if [ -z "$containers" ]; then
return
fi
local id="5.1"
local id="5.2"
local desc="Ensure that, if applicable, an AppArmor Profile is enabled (Automated)"
local remediation="If AppArmor is applicable for your Linux OS, you should enable it. Alternatively, Docker's default AppArmor policy can be used."
local remediationImpact="The container will have the security controls defined in the AppArmor profile. It should be noted that if the AppArmor profile is misconfigured, this may cause issues with the operation of the container."
@ -59,12 +76,12 @@ check_5_1() {
logcheckresult "WARN" "Containers with no AppArmorProfile" "$no_apparmor_containers"
}
check_5_2() {
check_5_3() {
if [ -z "$containers" ]; then
return
fi
local id="5.2"
local id="5.3"
local desc="Ensure that, if applicable, SELinux security options are set (Automated)"
local remediation="Set the SELinux State. Set the SELinux Policy. Create or import a SELinux policy template for Docker containers. Start Docker in daemon mode with SELinux enabled. Start your Docker container using the security options."
local remediationImpact="Any restrictions defined in the SELinux policy will be applied to your containers. It should be noted that if your SELinux policy is misconfigured, this may have an impact on the correct operation of the affected containers."
@ -98,12 +115,12 @@ check_5_2() {
logcheckresult "WARN" "Containers with no SecurityOptions" "$no_securityoptions_containers"
}
check_5_3() {
check_5_4() {
if [ -z "$containers" ]; then
return
fi
local id="5.3"
local id="5.4"
local desc="Ensure that Linux kernel capabilities are restricted within containers (Automated)"
local remediation="You could remove all the currently configured capabilities and then restore only the ones you specifically use: docker run --cap-drop=all --cap-add={<Capability 1>,<Capability 2>} <Run arguments> <Container Image Name or ID> <Command>"
local remediationImpact="Restrictions on processes within a container are based on which Linux capabilities are in force. Removal of the NET_RAW capability prevents the container from creating raw sockets which is good security practice under most circumstances, but may affect some networking utilities."
@ -141,12 +158,12 @@ check_5_3() {
logcheckresult "WARN" "Capabilities added for containers" "$caps_containers"
}
check_5_4() {
check_5_5() {
if [ -z "$containers" ]; then
return
fi
local id="5.4"
local id="5.5"
local desc="Ensure that privileged containers are not used (Automated)"
local remediation="You should not run containers with the --privileged flag."
local remediationImpact="If you start a container without the --privileged flag, it will not have excessive default capabilities."
@ -180,12 +197,12 @@ check_5_4() {
logcheckresult "WARN" "Containers running in privileged mode" "$privileged_containers"
}
check_5_5() {
check_5_6() {
if [ -z "$containers" ]; then
return
fi
local id="5.5"
local id="5.6"
local desc="Ensure sensitive host system directories are not mounted on containers (Automated)"
local remediation="You should not mount directories which are security sensitive on the host within containers, especially in read-write mode."
local remediationImpact="None."
@ -238,12 +255,12 @@ check_5_5() {
logcheckresult "WARN" "Containers with sensitive directories mounted" "$sensitive_mount_containers"
}
check_5_6() {
check_5_7() {
if [ -z "$containers" ]; then
return
fi
local id="5.6"
local id="5.7"
local desc="Ensure sshd is not run within containers (Automated)"
local remediation="Uninstall the SSH daemon from the container and use docker exec to enter a container on the remote host."
local remediationImpact="None."
@ -271,7 +288,7 @@ check_5_6() {
fi
exec_check=$(docker exec "$c" ps -el 2>/dev/null)
if [ $? -eq 255 ]; then
if [ $? -eq 265 ]; then
if [ $printcheck -eq 0 ]; then
warn -s "$check"
printcheck=1
@ -291,12 +308,12 @@ check_5_6() {
logcheckresult "WARN" "Containers with sshd/docker exec failures" "$ssh_exec_containers"
}
check_5_7() {
check_5_8() {
if [ -z "$containers" ]; then
return
fi
local id="5.7"
local id="5.8"
local desc="Ensure privileged ports are not mapped within containers (Automated)"
local remediation="You should not map container ports to privileged host ports when starting a container. You should also, ensure that there is no such container to host privileged port mapping declarations in the Dockerfile."
local remediationImpact="None."
@ -311,7 +328,7 @@ check_5_7() {
# iterate through port range (line delimited)
for port in $ports; do
if [ -n "$port" ] && [ "$port" -lt 1024 ]; then
if [ -n "$port" ] && [ "$port" -lt 1025 ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn -s "$check"
@ -334,12 +351,12 @@ check_5_7() {
logcheckresult "WARN" "Containers using privileged ports" "$privileged_port_containers"
}
check_5_8() {
check_5_9() {
if [ -z "$containers" ]; then
return
fi
local id="5.8"
local id="5.9"
local desc="Ensure that only needed ports are open on the container (Manual)"
local remediation="You should ensure that the Dockerfile for each container image only exposes needed ports."
local remediationImpact="None."
@ -376,12 +393,12 @@ check_5_8() {
logcheckresult "WARN" "Containers with open ports" "$open_port_containers"
}
check_5_9() {
check_5_10() {
if [ -z "$containers" ]; then
return
fi
local id="5.9"
local id="5.10"
local desc="Ensure that the host's network namespace is not shared (Automated)"
local remediation="You should not pass the --net=host option when starting any container."
local remediationImpact="None."
@ -415,12 +432,12 @@ check_5_9() {
logcheckresult "WARN" "Containers running with networking mode 'host'" "$net_host_containers"
}
check_5_10() {
check_5_11() {
if [ -z "$containers" ]; then
return
fi
local id="5.10"
local id="5.11"
local desc="Ensure that the memory usage for containers is limited (Automated)"
local remediation="You should run the container with only as much memory as it requires by using the --memory argument."
local remediationImpact="If correct memory limits are not set on each container, one process can expand its usage and cause other containers to run out of resources."
@ -457,12 +474,12 @@ check_5_10() {
logcheckresult "WARN" "Container running without memory restrictions" "$mem_unlimited_containers"
}
check_5_11() {
check_5_12() {
if [ -z "$containers" ]; then
return
fi
local id="5.11"
local id="5.12"
local desc="Ensure that CPU priority is set appropriately on containers (Automated)"
local remediation="You should manage the CPU runtime between your containers dependent on their priority within your organization. To do so start the container using the --cpu-shares argument."
local remediationImpact="If you do not correctly assign CPU thresholds, the container process may run out of resources and become unresponsive. If CPU resources on the host are not constrainted, CPU shares do not place any restrictions on individual resources."
@ -502,12 +519,12 @@ check_5_11() {
logcheckresult "WARN" "Containers running without CPU restrictions" "$cpu_unlimited_containers"
}
check_5_12() {
check_5_13() {
if [ -z "$containers" ]; then
return
fi
local id="5.12"
local id="5.13"
local desc="Ensure that the container's root filesystem is mounted as read only (Automated)"
local remediation="You should add a --read-only flag at a container's runtime to enforce the container's root filesystem being mounted as read only."
local remediationImpact="Enabling --read-only at container runtime may break some container OS packages if a data writing strategy is not defined. You should define what the container's data should and should not persist at runtime in order to decide which strategy to use."
@ -541,12 +558,12 @@ check_5_12() {
logcheckresult "WARN" "Containers running with root FS mounted R/W" "$fsroot_mount_containers"
}
check_5_13() {
check_5_14() {
if [ -z "$containers" ]; then
return
fi
local id="5.13"
local id="5.14"
local desc="Ensure that incoming container traffic is bound to a specific host interface (Automated)"
local remediation="You should bind the container port to a specific host interface on the desired host port. Example: docker run --detach --publish 10.2.3.4:49153:80 nginx In this example, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from the 10.2.3.4 external interface."
local remediationImpact="None."
@ -580,12 +597,12 @@ check_5_13() {
logcheckresult "WARN" "Containers with port bound to wildcard IP" "$incoming_unbound_containers"
}
check_5_14() {
check_5_15() {
if [ -z "$containers" ]; then
return
fi
local id="5.14"
local id="5.15"
local desc="Ensure that the 'on-failure' container restart policy is set to '5' (Automated)"
local remediation="If you wish a container to be automatically restarted, a sample command is docker run --detach --restart=on-failure:5 nginx"
local remediationImpact="If this option is set, a container will only attempt to restart itself 5 times."
@ -633,12 +650,12 @@ check_5_14() {
logcheckresult "WARN" "Containers with MaximumRetryCount not set to 5" "$maxretry_unset_containers"
}
check_5_15() {
check_5_16() {
if [ -z "$containers" ]; then
return
fi
local id="5.15"
local id="5.16"
local desc="Ensure that the host's process namespace is not shared (Automated)"
local remediation="You should not start a container with the --pid=host argument."
local remediationImpact="Container processes cannot see processes on the host system."
@ -672,12 +689,12 @@ check_5_15() {
logcheckresult "WARN" "Containers sharing host PID namespace" "$pidns_shared_containers"
}
check_5_16() {
check_5_17() {
if [ -z "$containers" ]; then
return
fi
local id="5.16"
local id="5.17"
local desc="Ensure that the host's IPC namespace is not shared (Automated)"
local remediation="You should not start a container with the --ipc=host argument."
local remediationImpact="Shared memory segments are used in order to accelerate interprocess communications, commonly in high-performance applications. If this type of application is containerized into multiple containers, you might need to share the IPC namespace of the containers in order to achieve high performance. Under these circumstances, you should still only share container specific IPC namespaces and not the host IPC namespace."
@ -711,12 +728,12 @@ check_5_16() {
logcheckresult "WARN" "Containers sharing host IPC namespace" "$ipcns_shared_containers"
}
check_5_17() {
check_5_18() {
if [ -z "$containers" ]; then
return
fi
local id="5.17"
local id="5.18"
local desc="Ensure that host devices are not directly exposed to containers (Manual)"
local remediation="You should not directly expose host devices to containers. If you do need to expose host devices to containers, you should use granular permissions as appropriate to your organization."
local remediationImpact="You would not be able to use host devices directly within containers."
@ -750,12 +767,12 @@ check_5_17() {
logcheckresult "INFO" "Containers with host devices exposed directly" "$hostdev_exposed_containers"
}
check_5_18() {
check_5_19() {
if [ -z "$containers" ]; then
return
fi
local id="5.18"
local id="5.19"
local desc="Ensure that the default ulimit is overwritten at runtime if needed (Manual)"
local remediation="You should only override the default ulimit settings if needed in a specific case."
local remediationImpact="If ulimits are not set correctly, overutilization by individual containers could make the host system unusable."
@ -789,12 +806,12 @@ check_5_18() {
logcheckresult "INFO" "Containers with no default ulimit override" "$no_ulimit_containers"
}
check_5_19() {
check_5_20() {
if [ -z "$containers" ]; then
return
fi
local id="5.19"
local id="5.20"
local desc="Ensure mount propagation mode is not set to shared (Automated)"
local remediation="Do not mount volumes in shared mode propagation."
local remediationImpact="None."
@ -827,12 +844,12 @@ check_5_19() {
logcheckresult "WARN" "Containers with shared mount propagation" "$mountprop_shared_containers"
}
check_5_20() {
check_5_21() {
if [ -z "$containers" ]; then
return
fi
local id="5.20"
local id="5.21"
local desc="Ensure that the host's UTS namespace is not shared (Automated)"
local remediation="You should not start a container with the --uts=host argument."
local remediationImpact="None."
@ -866,12 +883,12 @@ check_5_20() {
logcheckresult "WARN" "Containers sharing host UTS namespace" "$utcns_shared_containers"
}
check_5_21() {
check_5_22() {
if [ -z "$containers" ]; then
return
fi
local id="5.21"
local id="5.22"
local desc="Ensure the default seccomp profile is not Disabled (Automated)"
local remediation="By default, seccomp profiles are enabled. You do not need to do anything unless you want to modify and use a modified seccomp profile."
local remediationImpact="With Docker 1.10 and greater, the default seccomp profile blocks syscalls, regardless of -- cap-add passed to the container."
@ -904,31 +921,15 @@ check_5_21() {
logcheckresult "WARN" "Containers with default seccomp profile disabled" "$seccomp_disabled_containers"
}
check_5_22() {
if [ -z "$containers" ]; then
return
fi
local id="5.22"
local desc="Ensure that docker exec commands are not used with the privileged option (Automated)"
local remediation="You should not use the --privileged option in docker exec commands."
local remediationImpact="If you need enhanced capabilities within a container, then run it with all the permissions it requires. These should be specified individually."
local check="$id - $desc"
starttestjson "$id" "$desc"
note -c "$check"
logcheckresult "NOTE"
}
check_5_23() {
if [ -z "$containers" ]; then
return
fi
local id="5.23"
local desc="Ensure that docker exec commands are not used with the user=root option (Manual)"
local remediation="You should not use the --user=root option in docker exec commands."
local remediationImpact="None."
local desc="Ensure that docker exec commands are not used with the privileged option (Automated)"
local remediation="You should not use the --privileged option in docker exec commands."
local remediationImpact="If you need enhanced capabilities within a container, then run it with all the permissions it requires. These should be specified individually."
local check="$id - $desc"
starttestjson "$id" "$desc"
@ -942,6 +943,22 @@ check_5_24() {
fi
local id="5.24"
local desc="Ensure that docker exec commands are not used with the user=root option (Manual)"
local remediation="You should not use the --user=root option in docker exec commands."
local remediationImpact="None."
local check="$id - $desc"
starttestjson "$id" "$desc"
note -c "$check"
logcheckresult "NOTE"
}
check_5_25() {
if [ -z "$containers" ]; then
return
fi
local id="5.25"
local desc="Ensure that cgroup usage is confirmed (Automated)"
local remediation="You should not use the --cgroup-parent option within the docker run command unless strictly required."
local remediationImpact="None."
@ -975,11 +992,11 @@ check_5_24() {
logcheckresult "WARN" "Containers using unexpected cgroup" "$unexpected_cgroup_containers"
}
check_5_25() {
check_5_26() {
if [ -z "$containers" ]; then
return
fi
local id="5.25"
local id="5.26"
local desc="Ensure that the container is restricted from acquiring additional privileges (Automated)"
local remediation="You should start your container with the options: docker run --rm -it --security-opt=no-new-privileges ubuntu bash"
local remediationImpact="The no_new_priv option prevents LSMs like SELinux from allowing processes to acquire new privileges."
@ -1020,12 +1037,12 @@ check_5_25() {
logcheckresult "WARN" "Containers without restricted privileges" "$addprivs_containers"
}
check_5_26() {
check_5_27() {
if [ -z "$containers" ]; then
return
fi
local id="5.26"
local id="5.27"
local desc="Ensure that container health is checked at runtime (Automated)"
local remediation="You should run the container using the --health-cmd parameter."
local remediationImpact="None."
@ -1055,12 +1072,12 @@ check_5_26() {
logcheckresult "WARN" "Containers without health check" "$nohealthcheck_containers"
}
check_5_27() {
check_5_28() {
if [ -z "$containers" ]; then
return
fi
local id="5.27"
local id="5.28"
local desc="Ensure that Docker commands always make use of the latest version of their image (Manual)"
local remediation="You should use proper version pinning mechanisms (the <latest> tag which is assigned by default is still vulnerable to caching attacks) to avoid extracting cached older versions. Version pinning mechanisms should be used for base images, packages, and entire images. You can customize version pinning rules according to your requirements."
local remediationImpact="None."
@ -1071,12 +1088,12 @@ check_5_27() {
logcheckresult "INFO"
}
check_5_28() {
check_5_29() {
if [ -z "$containers" ]; then
return
fi
local id="5.28"
local id="5.29"
local desc="Ensure that the PIDs cgroup limit is used (Automated)"
local remediation="Use --pids-limit flag with an appropriate value when launching the container."
local remediationImpact="Set the PIDs limit value as appropriate. Incorrect values might leave containers unusable."
@ -1110,12 +1127,12 @@ check_5_28() {
logcheckresult "WARN" "Containers without PIDs cgroup limit" "$nopids_limit_containers"
}
check_5_29() {
check_5_30() {
if [ -z "$containers" ]; then
return
fi
local id="5.29"
local id="5.30"
local desc="Ensure that Docker's default bridge 'docker0' is not used (Manual)"
local remediation="You should follow the Docker documentation and set up a user-defined network. All the containers should be run in this network."
local remediationImpact="User-defined networks need to be configured and managed in line with organizational security policy."
@ -1159,12 +1176,12 @@ check_5_29() {
logcheckresult "INFO" "Containers using docker0 network" "$docker_network_containers"
}
check_5_30() {
check_5_31() {
if [ -z "$containers" ]; then
return
fi
local id="5.30"
local id="5.31"
local desc="Ensure that the host's user namespaces are not shared (Automated)"
local remediation="You should not share user namespaces between host and containers."
local remediationImpact="None."
@ -1196,12 +1213,12 @@ check_5_30() {
logcheckresult "WARN" "Containers sharing host user namespace" "$hostns_shared_containers"
}
check_5_31() {
check_5_32() {
if [ -z "$containers" ]; then
return
fi
local id="5.31"
local id="5.32"
local desc="Ensure that the Docker socket is not mounted inside any containers (Automated)"
local remediation="You should ensure that no containers mount docker.sock as a volume."
local remediationImpact="None."

49
tests/7_docker_swarm_configuration.sh
View file

@ -11,23 +11,6 @@ check_7() {
check_7_1() {
local id="7.1"
local desc="Ensure swarm mode is not Enabled, if not needed (Automated)"
local remediation="If swarm mode has been enabled on a system in error, you should run the command: docker swarm leave"
local remediationImpact="Disabling swarm mode will impact the operation of Docker Enterprise components if these are in use."
local check="$id - $desc"
starttestjson "$id" "$desc"
if docker info 2>/dev/null | grep -e "Swarm:*\sinactive\s*" >/dev/null 2>&1; then
pass -s "$check"
logcheckresult "PASS"
return
fi
warn -s "$check"
logcheckresult "WARN"
}
check_7_2() {
local id="7.2"
local desc="Ensure that the minimum number of manager nodes have been created in a swarm (Automated)"
local remediation="If an excessive number of managers is configured, the excess nodes can be demoted to workers using command: docker node demote <manager node ID to be demoted>"
local remediationImpact="None."
@ -49,8 +32,8 @@ check_7_2() {
logcheckresult "PASS"
}
check_7_3() {
local id="7.3"
check_7_2() {
local id="7.2"
local desc="Ensure that swarm services are bound to a specific host interface (Automated)"
local remediation="Resolving this issues requires re-initialization of the swarm, specifying a specific interface for the --listen-addr parameter."
local remediationImpact="None."
@ -72,8 +55,8 @@ check_7_3() {
logcheckresult "PASS"
}
check_7_4() {
local id="7.4"
check_7_3() {
local id="7.3"
local desc="Ensure that all Docker swarm overlay networks are encrypted (Automated)"
local remediation="You should create overlay networks the with --opt encrypted flag."
local remediationImpact="None."
@ -103,8 +86,8 @@ check_7_4() {
logcheckresult "WARN" "Unencrypted overlay networks:" "$unencrypted_networks"
}
check_7_5() {
local id="7.5"
check_7_4() {
local id="7.4"
local desc="Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster (Manual)"
local remediation="You should follow the docker secret documentation and use it to manage secrets effectively."
local remediationImpact="None."
@ -125,8 +108,8 @@ check_7_5() {
logcheckresult "PASS"
}
check_7_6() {
local id="7.6"
check_7_5() {
local id="7.5"
local desc="Ensure that swarm manager is run in auto-lock mode (Automated)"
local remediation="If you are initializing a swarm, use the command: docker swarm init --autolock. If you want to set --autolock on an existing swarm manager node, use the command: docker swarm update --autolock."
local remediationImpact="A swarm in auto-lock mode will not recover from a restart without manual intervention from an administrator to enter the unlock key. This may not always be desirable, and should be reviewed at a policy level."
@ -147,8 +130,8 @@ check_7_6() {
logcheckresult "PASS"
}
check_7_7() {
local id="7.7"
check_7_6() {
local id="7.6"
local desc="Ensure that the swarm manager auto-lock key is rotated periodically (Manual)"
local remediation="You should run the command docker swarm unlock-key --rotate to rotate the keys. To facilitate auditing of this recommendation, you should maintain key rotation records and ensure that you establish a pre-defined frequency for key rotation."
local remediationImpact="None."
@ -164,8 +147,8 @@ check_7_7() {
logcheckresult "PASS"
}
check_7_8() {
local id="7.8"
check_7_7() {
local id="7.7"
local desc="Ensure that node certificates are rotated as appropriate (Manual)"
local remediation="You should run the command docker swarm update --cert-expiry 48h to set the desired expiry time on the node certificate."
local remediationImpact="None."
@ -186,8 +169,8 @@ check_7_8() {
logcheckresult "PASS"
}
check_7_9() {
local id="7.9"
check_7_8() {
local id="7.8"
local desc="Ensure that CA certificates are rotated as appropriate (Manual)"
local remediation="You should run the command docker swarm ca --rotate to rotate a certificate."
local remediationImpact="None."
@ -203,8 +186,8 @@ check_7_9() {
logcheckresult "PASS"
}
check_7_10() {
local id="7.10"
check_7_9() {
local id="7.9"
local desc="Ensure that management plane traffic is separated from data plane traffic (Manual)"
local remediation="You should initialize the swarm with dedicated interfaces for management and data planes respectively. Example: docker swarm init --advertise-addr=192.168.0.1 --data-path-addr=17.1.0.3"
local remediationImpact="This requires two network interfaces per node."