4117-k8s-edct-conf-priv-etcd Configuration file permissions are not set to 644 or higher¶

Rule ID¶

• 4117-k8s-edct-conf-priv

Category¶

• container

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• If you are using Kubernetes etcd on a machine where systemd manages services, verify that the kubernetes.service file permissions are correctly set to 644 or more restrictive.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The kubernetes.etcd file contains sensitive parameters that can change the behavior of the Kubernetes daemon. Therefore, no user other than root should be able to write to it to maintain file integrity.

Risk Item¶

• Container Security

Audit Method¶

• Execute the following command to verify that the file permissions are set to "644" or more restrictive:

stat -c %a /etc/kubernetes/manifests/etcd.yaml

Remediation¶

• Execute the following command to modify the permissions of the three configuration files:

  #> chmod 644 /etc/kubernetes/manifests/etcd.yaml
  

  This will set the file permissions to "644".

Impact¶

• None

Default Value¶

• By default, the etcd.yaml permissions are 640

References¶

• etcd

• kubernetes-etcd

CIS Controls¶

• None