GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fixes #167 - use get_docker_cumulative_command_line_args to check TLS settings

Browse source 
Additionally, split warning into 2 parts:  no TLS, TLS w/o verification

Signed-off-by: Mr. Secure <ben.github@mrsecure.org>
This commit is contained in:
Mr. Secure 2016-09-24 19:42:39 -05:00
parent 5bf3e2894c
commit ee3e8dedb3
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
tests/2_docker_daemon_configuration.sh
View file

@ -52,19 +52,26 @@ fi
check_2_6="2.6 - Configure TLS authentication for Docker daemon"
get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1
if [ $? -eq 0 ]; then
get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
get_docker_cumulative_command_line_args '--tlskey' | grep 'tlskey=' >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_6"
info " * Docker daemon currently listening on TCP"
get_docker_cumulative_command_line_args '--tlsverify' | grep 'tlsverify' >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_2_6"
#pass " * Docker daemon currently listening on TCP with TLS and verification"
else
warn "$check_2_6"
warn " * Docker daemon currently listening on TCP with TLS, but no verification"
fi
else
warn "$check_2_6"
warn " * Docker daemon currently listening on TCP without --tlsverify"
warn " * Docker daemon currently listening on TCP without TLS"
fi
else
info "$check_2_6"
info " * Docker daemon not listening on TCP"
fi
# 2.7
check_2_7="2.7 - Set default ulimit as appropriate"
get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1