Details

By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the ‘insecure bind’ address and is set by default to localhost. Any requests to this address bypass authentication and authorization checks. If this insecure bind address is set to localhost, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place and have full control over the entire cluster.

Close or set the insecure bind address by setting the API server’s –insecure-bind-address flag to an IP or leave it unset and ensure that the –insecure-bind-port is not set.

Solution

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the value for the –insecure-bind-address setting.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R4_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-3
• CAT|I
• CCI|CCI-000213
• Rule-ID|SV-242388r712520_rule
• STIG-ID|CNTR-K8-000340
• Vuln-ID|V-242388

Source

• Tenable.com/audits