| Finding ID |
Severity |
Title |
Description |
|
V-252849
|
High |
Rancher MCM must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithms for transmission. |
The container platform and its components will adhere to NIST 800-52R2. To ensure that traffic coming through the ingress controller is re-encrypted internally, switch off port 80 on the service object and direct ingress traffic to port 443 over HTTPS. |
|
V-252843
|
High |
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process. |
RBAC Integration and Authn/Authz
Centralized authentication services provide additional functionality fulfilling security requirements:
- Multi-factor authentication, which is compatible with Rancher MCM.
- Disabling users after a period of time.
- Storage and transmission of secure information is encrypted.
- Secure authentication protocols such as LDAP over TLS, or LDAPS... |
|
V-257292
|
Medium |
Rancher MCM must enforce organization-defined circumstances and/or usage conditions for organization-defined accounts. |
Rancher MCM must verify the certificate used for Rancher's ingress is a valid DOD certificate. This is achieved by verifying the helm installation contains correct parameters. |
|
V-252847
|
Medium |
Rancher MCM must never automatically remove or disable emergency accounts. |
Emergency accounts are administrator accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system... |
|
V-252846
|
Medium |
Rancher MCM must allocate audit record storage and generate audit records associated with events, users, and groups. |
Rancher logging capability and optional aggregation
The Rancher server automatically logs everything at the container level. These logs are stored on the system which are then optionally picked up by further log aggregation systems.
Cluster administrators with authorized access can view logs produced by the Rancher server as well as... |
|
V-252845
|
Medium |
When allowed by the central authentication system, the default role assigned to a user must be User-Base. |
Rancher MCM uses roles for authentication. It is necessary to ensure the proper roles and permissions are configured. The role used by default does not ensure least privilege. The default role needs to be changed to allow least privilege access. |
|
V-252844
|
Medium |
Rancher MCM must generate audit records for all DoD-defined auditable events within all components in the platform. |
Audit logs must be enabled.
Rancher MCM provides audit record generation capabilities. Audit logs capture what happened, when it happened, who initiated it, and what cluster it affected to ensure non-repudiation of actions taken.
Audit logging at the platform level also needs to be enabled. This will need to be... |
