Detections
Analytics

1.2.2 Ensure that the --token-auth-file parameter is not set

Information

Do not use token based authentication.

The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication.

Solution

Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --token-auth-file=<filename> parameter.

Impact:

You will have to configure and use alternate authentication mechanisms such as certificates. Static token based authentication could not be used.

See Also

https://workbench.cisecurity.org/benchmarks/26831

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|16.4

Plugin: Unix

Control ID: bf71280961a8f1ae47ae7282de66de4ff78da9f43a7f2e7c2cd7d7e97086b24e