Container Service for Kubernetes:ACK security hardening based on MLPS

Category

Baseline

Description

Identity verification

Assign UIDs to the users that are logged on to the system and verify the identities of the users. Make sure that all UIDs are unique, and the information for identity verification is complex and periodically updated.

• Check whether all user accounts have passwords.

• Check whether all UIDs are unique.

• Check whether the complexity of passwords meets the requirements.

• Check whether passwords are periodically changed.

• Check whether the minimum password age is set. The minimum password age specifies the period of time that a password must be used before the password can be changed.

• Limit password reuse.

• Make sure that root is the only account whose UID is 0.

Prevent breach of authentication information transmitted over networks during remote server management.

• Check whether SSHD is forced to use the SSH2 protocol.

• Check whether insecure remote logon services, such as Telnet, are used.

Handle logon failures, and configure relevant features to automatically close sessions, limit logon abuse, and log out when sessions time out.

Check whether the account lockout policy is configured, idle sessions can be automatically closed, and the connection to the client can be automatically closed when the logon times out.

Access control

Allocate accounts and grant permissions to the users that are logged on to the system.

• Check whether accounts with the regular user, auditor, and security inspector roles are created besides administrators.

• Check whether the umask parameter is set to 027 or a higher security level.

• Check whether the permissions of each user on the home directory are set to 750 or a higher security level.

Rename or delete the default accounts, and modify the default passwords of the default accounts.

• Do not delete the root account in Linux. You only need to check whether SSH logon is forbidden.

• Forbid default accounts and database accounts to log on to the system, except for the root account.

• Check for weak passwords based on the weak password baseline.

Enforce access control on individual users or processes to limit their access to files and tables in databases.

Check whether access control is enforced on individual users to limit access to important files such as access control configuration files and user permission configuration files.

Delete or disable expired accounts and accounts that are no longer in use at the earliest opportunity to avoid account sharing.

• Forbid default accounts and database accounts to log on to the system, except for the root account.

• Lock or delete accounts that have been shut down or halted.

Follow the least privilege principle and isolate user permissions.

• Limit the use of the su command.

• Check the users (excluding the root user) that are granted the sudo privileges in the /etc/sudoers file. Do not grant all sudo privileges to these users, except for administrators.

The access control policy must be configured by the authorizer to grant permissions to principals.

• Check whether the permissions of each user on the home directory are set to 750 or a higher security level.

• Assign the ownership of unowned files or directories to an active user.

• Configure the ownership of the file that stores the SSH public key of the host and the permissions on the file.

• Configure the ownership of the file that stores the SSH private key of the host and the permissions on the file.

Security auditing

Periodically back up audit logs to protect them from being accidentally deleted, modified, or overwritten.

Check the configurations in the auditd.conf file, including the storage mode of audit logs, the number of rotated log files, and the maximum size of a log file. Alternatively, back up audit logs to the log server. If the vulnerability cannot be automatically patched, check whether the security audit feature is enabled.

Audit records must include the date and time of each event, involved users, event type, whether the event is successful, and other audit-relevant information.

Check whether the requirements for enabling security audit are met.

Enable security audit for all users and audit critical events and user behavior.

• Enable the auditd service.

• Enable the rsyslog or syslog-ng service.

• Record file deletion events.

• Record changes to sudoers, which determines the sudo privileges of users.

• Record events of user or user group changes. If a third-party log collection service is used, check the relevant settings accordingly.

Protect the audit daemon from unexpected interruptions.

The audit daemon is named auditd and the log daemon is named syslogd. Check whether these daemons are launched.

Intrusion prevention

Identify vulnerabilities and patch them after tests and assessment.

Use the vulnerability detection and patching feature provided by Security Center. If you have other methods to detect intrusion, ignore this baseline.

Install only the components and applications that you need.

• Uninstall the following applications if Alibaba Cloud Linux 3 is used: avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind.

• Uninstall the following applications if Alibaba Cloud Linux 2 is used: NetworkManager, avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind.

Disable the system services that you do not need, and close the default shared ports and high-risk ports.

• Disable the system services and file sharing services that you do not need.

• Close the following high-risk ports: 21, 23, 25, 111, 427, and 631.

• If you cannot modify the access control policy due to business requirements, ignore this baseline.

Detect intrusion to key nodes and generate alerts.

Use the intrusion detection and alerting feature provided by Security Center. If you use other methods to detect intrusion and generate alerts, ignore this baseline.

Specify connection modes or CIDR blocks to limit the access of clients.

• Alibaba Cloud Linux 3:

  1. Modify the /etc/ssh/sshd_config file based on the clients that need to connect to the server.

  2. Configure the AllowUsers <user>@<host> parameter based on your requirements.

     Note

     <user> specifies the username of the account that needs to log on to the server and <host> specifies the IP address of the server. Replace them with the actual values.

  3. Press the Esc key. Then, enter :wq and press the Enter key to save the change and exit.

  4. Run the sudo systemctl restart sshd command to restart the sshd service.

• Alibaba Cloud Linux 2:

  • The /etc/hosts.allow file specifies the IP addresses that are allowed to connect to the host. Do not specify ALL:ALL.

  • The /etc/hosts.deny file specifies the IP addresses that are forbidden to connect to the host. Specify ALL:ALL to forbid all connections.

  Use both the preceding whitelist and blacklist and configure the /etc/hosts.allow file before you configure etc/hosts.deny. If you use other methods, such as security groups or firewalls, to limit the access of clients, ignore this baseline.

Malicious code protection

• Alibaba Cloud Linux 3: Use malicious code protection technologies or the trust-based proactive security compliance verification mechanism to identify and block intrusion, virus, and malicious activities.

• Alibaba Cloud Linux 2: Install malicious code protection software and keep the software version and libraries up-to-date.

Check whether Security Center is installed and used. If other security software is used, ignore this baseline.