Detections
Analytics

1.2.1 Ensure that the --anonymous-auth argument is set to false

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Disable anonymous requests to the API server.

Rationale:

When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the API server. You should rely on authentication to authorize access and disallow anonymous requests.

If you are using RBAC authorization, it is generally considered reasonable to allow anonymous access to the API Server for health checks and discovery purposes, and hence this recommendation is not scored. However, you should consider whether anonymous discovery is an acceptable risk for your purposes.

Solution

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.

--anonymous-auth=false

Impact:

Anonymous requests will be rejected.

Default Value:

By default, anonymous access is enabled.

References:

https://kubernetes.io/docs/admin/kube-apiserver/

https://kubernetes.io/docs/admin/authentication/#anonymous-requests

See Also

https://workbench.cisecurity.org/files/2662

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2, CSCv6|14, CSCv7|14

Plugin: Unix

Control ID: 14e8dccd9d42c508eac2cda4e69327a91a561e0dbbf9158fda55ec4b958d6738