turbot/alicloud_compliance

Control: 7.6 Ensure Basic Authentication is not enabled on Kubernetes Engine

Description

Basic authentication allows a user to authenticate to the cluster with a username and password and it is stored in plain text without any encryption. Disabling Basic authentication will prevent attacks like brute force. Its recommended to use either client certificate or RAM for authentication.

Remediation

  1. ssh into any master node in cluster.
  2. Make sure the basic-auth-file not exist in apiserver manifest with below command:
cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep basic-auth-file
  1. If you found basic-auth-file existing in apiserver manitfest, please override the manifest file with new manifest content to not include the basic-auth-file and then restart the apiserver, you need repeat the action on all of the master nodes.

Usage

Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_7_6

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_7_6 --share

SQL

This control uses a named query:

manual_control

Tags