The Docker Enterprise max-size and max-file json-file drivers logging options in the daemon.json configuration file must be configured to allocate audit record storage capacity for Universal Control Plane (UCP) and Docker Trusted Registry (DTR) per the requirements set forth by the System Security Plan (SSP).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95697	DKER-EE-003310	SV-104835r1_rule		Medium

Description
By default, the UCP and DTR components of Docker Enterprise leverage the "json-file" Engine logging driver. This driver has configurable "max-size" and "max-file" options which are applicable in the context of this control. The "max-size" option defines the maximum size of the log before it is rolled. By default it is set to "unlimited" and is never rolled. The "max-file" option defines the maximum number of log files that can be present whereby if rolling the logs creates excess files, the oldest file is removed. This setting is only effective when "max-size" is also set. By default, "max-file" is set to "1". The Docker Engine - Enterprise audit logs are stored in default locations according to the chart on this site https://docs.docker.com/config/daemon/#read-the-logs. For the Engine's daemon logs, allocate sufficient storage for the default log locations on the underlying host operating system per the requirements set forth by the SSP.

Description

By default, the UCP and DTR components of Docker Enterprise leverage the "json-file" Engine logging driver. This driver has configurable "max-size" and "max-file" options which are applicable in the context of this control. The "max-size" option defines the maximum size of the log before it is rolled. By default it is set to "unlimited" and is never rolled. The "max-file" option defines the maximum number of log files that can be present whereby if rolling the logs creates excess files, the oldest file is removed. This setting is only effective when "max-size" is also set. By default, "max-file" is set to "1". The Docker Engine - Enterprise audit logs are stored in default locations according to the chart on this site https://docs.docker.com/config/daemon/#read-the-logs. For the Engine's daemon logs, allocate sufficient storage for the default log locations on the underlying host operating system per the requirements set forth by the SSP.

STIG	Date
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide	2019-09-13

Details

Check Text ( C-94527r1_chk )
This check only applies to the Docker Engine - Enterprise component of Docker Enterprise. via CLI: Linux: Execute the following commands as a trusted user on the host operating system: cat /etc/docker/daemon.json Verify that the "log-opts" object includes the "max-size" and "max-file" properties and that they are set according to requirements specified in the SSP. If they are not configured according to values defined in the SSP, this is a finding.

Check Text ( C-94527r1_chk )

This check only applies to the Docker Engine - Enterprise component of Docker Enterprise.

via CLI:

Linux: Execute the following commands as a trusted user on the host operating system:

cat /etc/docker/daemon.json

Verify that the "log-opts" object includes the "max-size" and "max-file" properties and that they are set according to requirements specified in the SSP. If they are not configured according to values defined in the SSP, this is a finding.

Fix Text (F-101365r1_fix)
This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise. via CLI: Linux: Execute the following commands as a trusted user on the host operating system: Open "/etc/docker/daemon.json" for editing. If the file doesn't exist, it must be created. Set the "log-opts" object and its "max-size" and "max-file" properties according to values defined in the SSP. Save the file. Restart the Docker daemon.

Fix Text (F-101365r1_fix)

This fix only applies to the Docker Engine - Enterprise component of Docker Enterprise.

via CLI:

Linux: Execute the following commands as a trusted user on the host operating system:

Open "/etc/docker/daemon.json" for editing. If the file doesn't exist, it must be created.

Set the "log-opts" object and its "max-size" and "max-file" properties according to values defined in the SSP.

Save the file. Restart the Docker daemon.