CNTR-K8-000410 - Kubernetes Worker Nodes must not have the sshd service enabled.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Worker Nodes are maintained and monitored by the Master Node. Direct access and manipulation of the nodes must not take place by administrators. Worker nodes must be treated as immutable and updated via replacement rather than in-place upgrades.

Solution

To disable the sshd service, run the command:

chkconfig sshd off

Note: If access to the worker node is through an SSH session, it is important to realize there are two requirements for disabling and stopping the sshd service that must be done during the same SSH session. Disabling the service must be performed first and then the service stopped to guarantee both settings can be made if the session is interrupted.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R6_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000213, Rule-ID|SV-242394r717017_rule, STIG-ID|CNTR-K8-000410, Vuln-ID|V-242394

Plugin: Unix

Control ID: 6b6742b09ead0eb72f013fb1cf2582a04557e2cb1afb6685eedeb2b15ea59f05