When allowed by the central authentication system, the default role assigned to a user must be User-Base.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-252845	CNTR-RM-000080	SV-252845r960783_rule		Medium

Description
Rancher MCM uses roles for authentication. It is necessary to ensure the proper roles and permissions are configured. The role used by default does not ensure least privilege. The default role needs to be changed to allow least privilege access.

STIG	Date
Rancher Government Solutions Multi-Cluster Manager Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-56301r822505_chk )
Verify User-Base is the default assigned role: -From the GUI, navigate to Triple Bar Symbol(Global) >> Users & Authentication >> Roles. -Click "Standard User". -At the top right, click the three dots, and then choose "Edit Config". -Under "New User Default", ensure "No" is selected. -Click "User-Base". -At the top right, click the three dots, and then "Edit Config". -Under "New User Default", ensure "Yes" is selected. If "No" is not selected for Standard User, this is a finding. If "Yes" is not selected for User-Base, this is a finding.

Check Text ( C-56301r822505_chk )

Verify User-Base is the default assigned role:
-From the GUI, navigate to Triple Bar Symbol(Global) >> Users & Authentication >> Roles.
-Click "Standard User".
-At the top right, click the three dots, and then choose "Edit Config".
-Under "New User Default", ensure "No" is selected.
-Click "User-Base".
-At the top right, click the three dots, and then "Edit Config".
-Under "New User Default", ensure "Yes" is selected.

If "No" is not selected for Standard User, this is a finding.

If "Yes" is not selected for User-Base, this is a finding.

Fix Text (F-56251r822506_fix)
From the GUI, navigate to Triple Bar Symbol(Global) >> Users & Authentication >> Roles. -Click "Standard User". -At the top right, click the three dots, and then "Edit Config". -Under "New User Default", select "No" and click "Save". -Click "User-Base". -At the top right, click the three dots, and then click "Edit Config". -Under "New User Default", select "Yes", and then click "Save".