UCF STIG Viewer Logo

Kubernetes Worker Nodes must not have the sshd service enabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-242394 CNTR-K8-000410 SV-242394r717017_rule Medium
Description
Worker Nodes are maintained and monitored by the Master Node. Direct access and manipulation of the nodes must not take place by administrators. Worker nodes must be treated as immutable and updated via replacement rather than in-place upgrades.
STIG Date
Kubernetes Security Technical Implementation Guide 2021-06-17

Details

Check Text ( C-45669r712536_chk )
Log in to each worker node. Verify that the sshd service is not enabled. To validate the service is not enabled, run the command:

systemctl is-enabled sshd.service

If the service sshd is enabled, this is a finding.

Note: If console access is not available, SSH access can be attempted. If the worker nodes cannot be reached, this requirement is "not a finding".
Fix Text (F-45627r717016_fix)
To disable the sshd service, run the command:

chkconfig sshd off

Note: If access to the worker node is through an SSH session, it is important to realize there are two requirements for disabling and stopping the sshd service that must be done during the same SSH session. Disabling the service must be performed first and then the service stopped to guarantee both settings can be made if the session is interrupted.