Detections
Analytics

1.2.2 Ensure that the --basic-auth-file argument is not set

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Do not use basic authentication.

Rationale:

Basic authentication uses plaintext credentials for authentication. Currently, the basic authentication credentials last indefinitely, and the password cannot be changed without restarting the API server. The basic authentication is currently supported for convenience. Hence, basic authentication should not be used.

Impact:

You will have to configure and use alternate authentication mechanisms such as tokens and certificates. Username and password for basic authentication could no longer be used.

Solution

Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --basic-auth-file=<filename> parameter.

Default Value:

By default, basic authentication is not set.

See Also

https://workbench.cisecurity.org/files/2968

Item Details

References: CSCv6|16.14, CSCv7|16.4

Plugin: Unix

Control ID: 3329adb71c9715f5977bcfcc9812134107b2f03a5ae162380a4f08c329a63591