Skip to content

Commit 90243de

Browse files
slashbenYiscahLevySilas1
slashben
and
YiscahLevySilas1
authored
Control implementations for CIS 1.10 implementation (#658)
* Added rule/control for API server string TLS cipher suite verification (CIS 1.10 is 1.2.29) Signed-off-by: Ben <[email protected]> * Implementing controls for CIS 1.10 5.1.9 to 5.1.13 Signed-off-by: Ben <[email protected]> * Fix rule name Signed-off-by: Ben <[email protected]> * Update controls/C-0277-ensurethattheapiserveronlymakesuseofstrongcryptographicciphers-new.json fix link Signed-off-by: YiscahLevySilas1 <[email protected]> --------- Signed-off-by: Ben <[email protected]> Signed-off-by: YiscahLevySilas1 <[email protected]> Co-authored-by: YiscahLevySilas1 <[email protected]>
1 parent 39d812f commit 90243de

File tree

70 files changed

+2580
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+2580
-0
lines changed

‎controls/C-0277-ensurethattheapiserveronlymakesuseofstrongcryptographicciphers-new.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"controlID": "C-0277",
3+
"name": "Ensure that the API Server only makes use of Strong Cryptographic Ciphers",
4+
"description": "Ensure that the API server is configured to only use strong cryptographic ciphers.",
5+
"long_description": "TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.",
6+
"remediation": "Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the below parameter.\n\n \n```\n--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.\n\n```",
7+
"manual_test": "Run the following command on the Control Plane node:\n\n \n```\nps -ef | grep kube-apiserver\n\n```\n Verify that the `--tls-cipher-suites` argument is set as outlined in the remediation procedure below.",
8+
"references": [
9+
"https://workbench.cisecurity.org/sections/2633389/recommendations/4262031"
10+
],
11+
"attributes": {
12+
},
13+
"rulesNames": [
14+
"ensure-that-the-API-Server-only-makes-use-of-Strong-Cryptographic-Ciphers-cis1-10"
15+
],
16+
"baseScore": 5,
17+
"impact_statement": "API server clients that cannot support modern cryptographic ciphers will not be able to make connections to the API server.",
18+
"default_value": "By default the Kubernetes API server supports a wide range of TLS ciphers",
19+
"category": {
20+
"name" : "Control plane"
21+
},
22+
"scanningScope": {
23+
"matches": [
24+
"cluster"
25+
]
26+
}
27+
}

‎controls/C-0278-minimizeaccesstocreatepv.json

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Minimize access to create persistent volumes",
3+
"controlID": "C-0278",
4+
"description": "The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of hostPath volumes. ",
5+
"long_description": "The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of hostPath volumes. As persistent volumes are not covered by Pod Security Admission, a user with access to create persistent volumes may be able to get access to sensitive files from the underlying host even where restrictive Pod Security Admission policies are in place.",
6+
"remediation": "Where possible, remove `create` access to `persistentvolume` objects in the cluster.",
7+
"manual_test": "Review the users who have create access to persistentvolume objects in the Kubernetes API.",
8+
"test": "Check which subjects have RBAC permissions to create persistentvolumes.",
9+
"references": [
10+
"https://workbench.cisecurity.org/sections/2633388/recommendations/4261959"
11+
],
12+
"attributes": {
13+
},
14+
"rulesNames": [
15+
"rule-can-create-pv"
16+
],
17+
"baseScore": 5,
18+
"impact_statement": "Care should be taken not to remove access to pods to system components which require this for their operation",
19+
"category": {
20+
"name" : "Access control"
21+
},
22+
"default_value": "By default in a kubeadm cluster the following list of principals have `create` privileges on `persistentvolume` objects ```CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACEcluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-systemsystem:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-systemsystem:controller:job-controller job-controller ServiceAccount kube-systemsystem:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-systemsystem:controller:replicaset-controller replicaset-controller ServiceAccount kube-systemsystem:controller:replication-controller replication-controller ServiceAccount kube-systemsystem:controller:statefulset-controller statefulset-controller ServiceAccount kube-system```",
23+
"scanningScope": {
24+
"matches": [
25+
"cluster",
26+
"file"
27+
]
28+
}
29+
}

‎controls/C-0279-minimizeaccesstonodeproxy.json

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Minimize access to the proxy sub-resource of nodes",
3+
"controlID": "C-0279",
4+
"description": "Users with access to the Proxy sub-resource of Node objects automatically have permissions to use the Kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs.",
5+
"long_description": "Users with access to the Proxy sub-resource of Node objects automatically have permissions to use the Kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs. The Kubelet provides an API which includes rights to execute commands in any container running on the node. Access to this API is covered by permissions to the main Kubernetes API via the node object. The proxy sub-resource specifically allows wide ranging access to the Kubelet API. Direct access to the Kubelet API bypasses controls like audit logging (there is no audit log of Kubelet API access) and admission control.",
6+
"remediation": "Where possible, remove access to the proxy sub-resource of node objects.",
7+
"manual_test": "Review the users who have access to the proxy sub-resource of node objects in the Kubernetes API.",
8+
"test": "Check which subjects have RBAC permissions to access the proxy sub-resource of node objects.",
9+
"references": [
10+
"https://workbench.cisecurity.org/sections/2633388/recommendations/4261961"
11+
],
12+
"attributes": {
13+
},
14+
"rulesNames": [
15+
"rule-can-access-proxy-subresource"
16+
],
17+
"baseScore": 5,
18+
"impact_statement": "Users with access to the proxy sub-resource of node objects automatically have permissions to use the Kubelet API, which may allow for privilege escalation or bypass cluster security controls such as audit logs.",
19+
"category": {
20+
"name" : "Access control"
21+
},
22+
"default_value": "By default in a kubeadm cluster the following list of principals have `create` privileges on `node/proxy` objects ```CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACEcluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-systemsystem:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-systemsystem:controller:job-controller job-controller ServiceAccount kube-systemsystem:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-systemsystem:controller:replicaset-controller replicaset-controller ServiceAccount kube-systemsystem:controller:replication-controller replication-controller ServiceAccount kube-systemsystem:controller:statefulset-controller statefulset-controller ServiceAccount kube-system```",
23+
"scanningScope": {
24+
"matches": [
25+
"cluster",
26+
"file"
27+
]
28+
}
29+
}

‎controls/C-0280-minimizeaccesstocertsigningreq.json

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Minimize access to the approval sub-resource of certificatesigningrequests objects",
3+
"controlID": "C-0280",
4+
"description": "Users with access to the update the approval sub-resource of certificateaigningrequests objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts.",
5+
"long_description": "Users with access to the update the approval sub-resource of certificateaigningrequests objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts. This can allow for privilege escalation to full cluster administrator, depending on users configured in the cluster",
6+
"remediation": "Where possible, remove access to the approval sub-resource of certificatesigningrequests objects.",
7+
"manual_test": "Review the users who have access to update the approval sub-resource of certificatesigningrequests objects in the Kubernetes API.",
8+
"test": "Check which subjects have RBAC permissions to update the approval sub-resource of certificatesigningrequests objects.",
9+
"references": [
10+
"https://workbench.cisecurity.org/sections/2633388/recommendations/4261962"
11+
],
12+
"attributes": {
13+
},
14+
"rulesNames": [
15+
"rule-can-approve-cert-signing-request"
16+
],
17+
"baseScore": 5,
18+
"impact_statement": "Users with access to the approval sub-resource of certificatesigningrequests objects can approve new client certificates for the Kubernetes API effectively allowing them to create new high-privileged user accounts.",
19+
"category": {
20+
"name" : "Access control"
21+
},
22+
"default_value": "By default in a kubeadm cluster the following list of principals have `update` privileges on `certificatesigningrequests/approval` objects ```CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACEcluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-systemsystem:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-systemsystem:controller:job-controller job-controller ServiceAccount kube-systemsystem:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-systemsystem:controller:replicaset-controller replicaset-controller ServiceAccount kube-systemsystem:controller:replication-controller replication-controller ServiceAccount kube-systemsystem:controller:statefulset-controller statefulset-controller ServiceAccount kube-system```",
23+
"scanningScope": {
24+
"matches": [
25+
"cluster",
26+
"file"
27+
]
28+
}
29+
}

‎controls/C-0281-minimizeaccesstoadmissionwebhook.json

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Minimize access to webhook configuration objects",
3+
"controlID": "C-0281",
4+
"description": "Users with rights to create/modify/delete validatingwebhookconfigurations or mutatingwebhookconfigurations can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.",
5+
"long_description": "Users with rights to create/modify/delete validatingwebhookconfigurations or mutatingwebhookconfigurations can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.",
6+
"remediation": "Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects",
7+
"manual_test": "Review the users who have access to validatingwebhookconfigurations or mutatingwebhookconfigurations objects in the Kubernetes API.",
8+
"test": "Check which subjects have RBAC permissions to create/modify/delete validatingwebhookconfigurations or mutatingwebhookconfigurations objects.",
9+
"references": [
10+
"https://workbench.cisecurity.org/sections/2633388/recommendations/4261963"
11+
],
12+
"attributes": {
13+
},
14+
"rulesNames": [
15+
"rule-can-modify-admission-webhooks"
16+
],
17+
"baseScore": 5,
18+
"impact_statement": "Users with rights to create/modify/delete validatingwebhookconfigurations or mutatingwebhookconfigurations can control webhooks that can read any object admitted to the cluster, and in the case of mutating webhooks, also mutate admitted objects. This could allow for privilege escalation or disruption of the operation of the cluster.",
19+
"category": {
20+
"name" : "Access control"
21+
},
22+
"default_value": "By default in a kubeadm cluster the following list of principals have `create/modify/delete` privileges on `validatingwebhookconfigurations/mutatingwebhookconfigurations` objects ```CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACEcluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-systemsystem:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-systemsystem:controller:job-controller job-controller ServiceAccount kube-systemsystem:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-systemsystem:controller:replicaset-controller replicaset-controller ServiceAccount kube-systemsystem:controller:replication-controller replication-controller ServiceAccount kube-systemsystem:controller:statefulset-controller statefulset-controller ServiceAccount kube-system```",
23+
"scanningScope": {
24+
"matches": [
25+
"cluster",
26+
"file"
27+
]
28+
}
29+
}

‎controls/C-0282-minimizeaccesstoserviceaccountcreate.json

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Minimize access to the service account token creation",
3+
"controlID": "C-0282",
4+
"description": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.",
5+
"long_description": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.",
6+
"remediation": "Where possible, remove access to the token sub-resource of serviceaccount objects.",
7+
"manual_test": "Review the users who have access to create the token sub-resource of serviceaccount objects in the Kubernetes API.",
8+
"test": "Check which subjects have RBAC permissions to create the token sub-resource of serviceaccount objects.",
9+
"references": [
10+
"https://workbench.cisecurity.org/sections/2633388/recommendations/4261965"
11+
],
12+
"attributes": {
13+
},
14+
"rulesNames": [
15+
"rule-can-create-service-account-token"
16+
],
17+
"baseScore": 5,
18+
"impact_statement": "Users with rights to create new service account tokens at a cluster level, can create long-lived privileged credentials in the cluster. This could allow for privilege escalation and persistent access to the cluster, even if the users account has been revoked.",
19+
"category": {
20+
"name" : "Access control"
21+
},
22+
"default_value": "By default in a kubeadm cluster the following list of principals have `create` privileges on `serviceaccount/token` objects ```CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACEcluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterrole-aggregation-controller ServiceAccount kube-systemsystem:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-systemsystem:controller:job-controller job-controller ServiceAccount kube-systemsystem:controller:persistent-volume-binder persistent-volume-binder ServiceAccount kube-systemsystem:controller:replicaset-controller replicaset-controller ServiceAccount kube-systemsystem:controller:replication-controller replication-controller ServiceAccount kube-systemsystem:controller:statefulset-controller statefulset-controller ServiceAccount kube-system```",
23+
"scanningScope": {
24+
"matches": [
25+
"cluster",
26+
"file"
27+
]
28+
}
29+
}

‎rules/ensure-that-the-API-Server-only-makes-use-of-Strong-Cryptographic-Ciphers-cis1-10/filter.rego

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package armo_builtins
2+
3+
deny[msg] {
4+
obj = input[_]
5+
is_api_server(obj)
6+
msg := {"alertObject": {"k8sApiObjects": [obj]}}
7+
}
8+
9+
is_api_server(obj) {
10+
obj.apiVersion == "v1"
11+
obj.kind == "Pod"
12+
obj.metadata.namespace == "kube-system"
13+
count(obj.spec.containers) == 1
14+
count(obj.spec.containers[0].command) > 0
15+
endswith(obj.spec.containers[0].command[0], "kube-apiserver")
16+
}

‎rules/ensure-that-the-API-Server-only-makes-use-of-Strong-Cryptographic-Ciphers-cis1-10/raw.rego

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
package armo_builtins
2+
3+
import future.keywords.in
4+
5+
deny[msg] {
6+
obj = input[_]
7+
is_api_server(obj)
8+
dontwanted = [
9+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
10+
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
11+
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
12+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
13+
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
14+
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
15+
"TLS_RSA_WITH_AES_128_CBC_SHA",
16+
"TLS_RSA_WITH_AES_128_CBC_SHA256",
17+
"TLS_RSA_WITH_AES_128_GCM_SHA256",
18+
"TLS_RSA_WITH_AES_256_CBC_SHA",
19+
"TLS_RSA_WITH_AES_256_GCM_SHA384",
20+
"TLS_RSA_WITH_RC4_128_SHA"
21+
]
22+
23+
result = invalid_flag(obj.spec.containers[0].command, dontwanted)
24+
msg := {
25+
"alertMessage": "The API server is not configured to use strong cryptographic ciphers",
26+
"alertScore": 2,
27+
"reviewPaths": result.failed_paths,
28+
"failedPaths": result.failed_paths,
29+
"fixPaths": result.fix_paths,
30+
31+
"packagename": "armo_builtins",
32+
"alertObject": {"k8sApiObjects": [obj]},
33+
}
34+
}
35+
36+
is_api_server(obj) {
37+
obj.apiVersion == "v1"
38+
obj.kind == "Pod"
39+
obj.metadata.namespace == "kube-system"
40+
count(obj.spec.containers) == 1
41+
count(obj.spec.containers[0].command) > 0
42+
endswith(obj.spec.containers[0].command[0], "kube-apiserver")
43+
}
44+
45+
get_flag_values(cmd) = {"origin": origin, "values": values} {
46+
re := " ?--tls-cipher-suites=(.+?)(?: |$)"
47+
matchs := regex.find_all_string_submatch_n(re, cmd, -1)
48+
count(matchs) == 1
49+
values := [val | val := split(matchs[0][1], ",")[j]; val != ""]
50+
origin := matchs[0][0]
51+
}
52+
53+
54+
# Assume flag set only once
55+
invalid_flag(cmd, dontwanted) = result {
56+
flag := get_flag_values(cmd[i])
57+
58+
# value check
59+
dontuse = [x | x = dontwanted[_]; x in flag.values]
60+
count(dontuse) > 0
61+
62+
63+
# get fixed and failed paths
64+
fixed_values := array.concat(flag.values, dontuse)
65+
fixed_flag = sprintf("%s=%s", ["--tls-cipher-suites", concat(",", fixed_values)])
66+
fixed_cmd = replace(cmd[i], flag.origin, fixed_flag)
67+
path := sprintf("spec.containers[0].command[%d]", [i])
68+
69+
70+
result := {
71+
"failed_paths": [path],
72+
"fix_paths": [{
73+
"path": path,
74+
"value": fixed_cmd,
75+
}],
76+
}
77+
}
78+
79+
invalid_flag(cmd, wanted) = result {
80+
full_cmd := concat(" ", cmd)
81+
not contains(full_cmd, "--tls-cipher-suites")
82+
83+
path = sprintf("spec.containers[0].command[%d]", [count(cmd)])
84+
result = {
85+
"failed_paths": [],
86+
"fix_paths": [{
87+
"path": path,
88+
"value": sprintf("--tls-cipher-suites=%s", [concat(",", wanted)]),
89+
}],
90+
}
91+
}

0 commit comments

Comments
 (0)