Detections
Analytics

4.2.6 Ensure that the --streaming-connection-idle-timeout argument is not set to 0

Information

Do not disable timeouts on streaming connections.

Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.

Note: By default, --streaming-connection-idle-timeout is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Follow the instructions in the documentation https://docs.openshift.com/container-platform/latest/post_installation_configuration/machine-configuration-tasks.html#create-a-kubeletconfig-crd-to-edit-kubelet-parameters_post-install-machine-configuration-tasks to create a kubeletconfig CRD and set the streamingConnectionIdleTimeout to the desired value. Do not set the value to 0.

Impact:

Long-lived connections could be interrupted.

See Also

https://workbench.cisecurity.org/benchmarks/24114

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: OpenShift

Control ID: 8077b3710f6c24be7c4b512bf7ed3e459793a0fa9bb880b6a32c90364319886c