1.5.5 Ensure that the --peer-client-cert-auth argument is set to true


etcd should be configured for peer authentication.


etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster.

Note: This recommendation is applicable only for etcd clusters. If you are using only one etcd server in your environment then this recommendation is not applicable.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Edit the etcd environment file (for example, `/etc/etcd/etcd.conf`) on the etcd server node and set the `ETCD_PEER_CLIENT_CERT_AUTH` parameter to `'true'`: `ETCD_PEER_CLIENT_CERT_AUTH='true'`

Edit the etcd startup file (for example, `/etc/systemd/system/multi-user.target.wants/etcd.service`) and configure the startup parameter for `--peer-client-cert-auth` and set it to `'${ETCD_PEER_CLIENT_CERT_AUTH}'`: `ExecStart=/bin/bash -c 'GOMAXPROCS=$(nproc) /usr/bin/etcd --name='${ETCD_NAME}' --data-dir='${ETCD_DATA_DIR}' --listen-client-urls='${ETCD_LISTEN_CLIENT_URLS}' --peer-client-cert-auth='${ETCD_PEER_CLIENT_CERT_AUTH}''`

Based on your system, reload the daemon and restart the etcd service. For example, `systemctl daemon-reload systemctl restart etcd.service`


All peers attempting to communicate with the etcd server will require a valid client certificate for authentication.

See Also


Item Details


References: 800-53|IA-5(2), CSCv6|14.4

Plugin: Unix

Control ID: 8800781e9d0c1d6cf9a13aa9a25656b149a4211ac61fe6317b0ee972829da10b