Docker Swarm must have the minimum number of manager nodes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95731	DKER-EE-005060	SV-104869r1_rule		Medium

Description
Ensure that the minimum number of required manager nodes is created in a swarm. Manager nodes within a swarm have control over the swarm and change its configuration modifying security parameters. Having excessive manager nodes could render the swarm more susceptible to compromise. If fault tolerance is not required in the manager nodes, a single node should be elected as a manger. If fault tolerance is required then the smallest practical odd number to achieve the appropriate level of tolerance should be configured.

Description

Ensure that the minimum number of required manager nodes is created in a swarm. Manager nodes within a swarm have control over the swarm and change its configuration modifying security parameters. Having excessive manager nodes could render the swarm more susceptible to compromise. If fault tolerance is not required in the manager nodes, a single node should be elected as a manger. If fault tolerance is required then the smallest practical odd number to achieve the appropriate level of tolerance should be configured.

STIG	Date
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide	2019-09-13

Details

Check Text ( C-94561r1_chk )
Ensure the correct range of manager nodes have been created in a swarm. via CLI: Linux: As a Docker EE Admin, follow the steps below using a Universal Control Plane (UCP) client bundle: Run the following command. docker info --format '{{ .Swarm.Managers }}' Alternatively run the below command. docker node ls \| grep 'Leader' Ensure the number of leaders is between 1 and 3. If the number of leaders is not 1, 2 or 3, this is a finding.

Check Text ( C-94561r1_chk )

Ensure the correct range of manager nodes have been created in a swarm.

via CLI:

Linux: As a Docker EE Admin, follow the steps below using a Universal Control Plane (UCP) client bundle:

Run the following command.
docker info --format '{{ .Swarm.Managers }}'

Alternatively run the below command.

docker node ls | grep 'Leader'

Ensure the number of leaders is between 1 and 3. If the number of leaders is not 1, 2 or 3, this is a finding.

Fix Text (F-101399r1_fix)
If an excessive number of managers is configured, the excess can be demoted to worker using the following command: docker node demote Where is the node ID value of the manager to be demoted.