Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Docker Enterprise Swarm services must be bound to a specific host interface.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-235873 | DKER-EE-006270 | SV-235873r627746_rule | Medium |
| Description |
|---|
| By default, the docker swarm services will listen to all interfaces on the host, which may not be necessary for the operation of the swarm where the host has multiple network interfaces. When a swarm is initialized the default value for the --listen-addr flag is 0.0.0.0:2377 which means that the swarm services will listen on all interfaces on the host. If a host has multiple network interfaces this may be undesirable as it may expose the docker swarm services to networks which are not involved in the operation of the swarm. By passing a specific IP address to the --listen-addr, a specific network interface can be specified limiting this exposure. |
| STIG | Date |
|---|---|
| Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide | 2021-03-26 |
Details
| Check Text ( C-39092r627744_chk ) |
|---|
| Ensure swarm services are bound to a specific host interface. Linux: List the network listener on port 2377/TCP (the default for docker swarm) and confirm that it is only listening on specific interfaces. For example, using ubuntu this could be done with the following command: netstat -lt | grep -i 2377 If the swarm service is not bound to a specific host interface address, this is a finding. |
| Fix Text (F-39055r627745_fix) |
|---|
| Rebuild the cluster and utilize the --listen-addr parameter. |