elastic · uri-weisman · Jun 8, 2022 · Jun 8, 2022 · Jun 8, 2022 · Jun 8, 2022
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.0.12"
+  changes:
+    - description: Add new rule templates
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3486
 - version: "0.0.11"
   changes:
     - description: Update elastic-agent deployment instructions

@@ -0,0 +1,31 @@
+{
+    "id": "0e3755af-d150-504f-80db-3a5bb1094c4e",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "0e3755af-d150-504f-80db-3a5bb1094c4e",
+        "name": "Ensure that the API Server only makes use of StrongCryptographic Ciphers (Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "Ensure that the API server is configured to only use strong cryptographic ciphers.\n",
+        "rationale": "TLS ciphers have had a number of known vulnerabilities and weaknesses, which can\nreduce the protection provided by them. By default Kubernetes supports a number of TLS\ncipher suites including some that have security concerns, weakening the protection\nprovided.\n",
+        "audit": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--tls-cipher-suites` argument is set as outlined in the remediation procedure below.\n",
+        "remediation": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`\non the Control Plane node and set the below parameter. ``` --tls-cipher-suites=TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384,\nTLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,\nTLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA,\nTLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,\nTLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384. ```\n",
+        "impact": "API server clients that cannot support modern cryptographic ciphers will not be able to\nmake connections to the API server.\n",
+        "default_value": "By default the Kubernetes API server supports a wide range of TLS ciphers\n",
+        "references": "1. https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-\nPractices#23-use-secure-cipher-suites\n",
+        "section": "API Server",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.2.32",
+            "API Server"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_2_32"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "428bd666-2825-532e-a484-0f31ea5db0f9",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "428bd666-2825-532e-a484-0f31ea5db0f9",
+        "name": "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "Ensure that Kubernetes PKI certificate files have permissions of 644 or more restrictive.\n",
+        "rationale": "Kubernetes makes use of a number of certificate files as part of the operation of its components.\nThe permissions on these files should be set to 644 or more restrictive to protect their integrity.\n",
+        "audit": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` ls -laR /etc/kubernetes/pki/*.crt ``` Verify that the permissions are 644 or more restrictive.\n",
+        "remediation": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` chmod -R 644 /etc/kubernetes/pki/*.crt ```\n",
+        "impact": "None\n",
+        "default_value": "By default, the certificates used by Kubernetes are set to have permissions of 644\n",
+        "references": "1. https://kubernetes.io/docs/admin/kube-apiserver/\n",
+        "section": "Master Node Configuration Files",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.1.20",
+            "Master Node Configuration Files"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_1_20"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "5ee652ed-952d-57d3-8643-87f95d046f25",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "5ee652ed-952d-57d3-8643-87f95d046f25",
+        "name": "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "Ensure that Kubernetes PKI key files have permissions of 600.\n",
+        "rationale": "Kubernetes makes use of a number of key files as part of the operation of its components.\nThe permissions on these files should be set to 600 to protect their integrity and confidentiality.\n",
+        "audit": "Run the below command (based on the file location on your system) on the Control Plane node. For example, ``` ls -laR /etc/kubernetes/pki/*.key ``` Verify that the permissions are 600.\n",
+        "remediation": "Run the below command (based on the file location on your system) on the  Control Plane node. For example, ``` chmod -R 600 /etc/kubernetes/pki/*.key ```\n",
+        "impact": "None\n",
+        "default_value": "By default, the keys used by Kubernetes are set to have permissions of 600\n",
+        "references": "1. https://kubernetes.io/docs/admin/kube-apiserver/\n",
+        "section": "Master Node Configuration Files",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.1.21",
+            "Master Node Configuration Files"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_1_21"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "743de18a-f988-55e3-b6a9-0b692d1e25fb",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "743de18a-f988-55e3-b6a9-0b692d1e25fb",
+        "name": "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)",
+        "profile_applicability": "• Level 1 - Worker Node\n",
+        "description": "Ensure that the kubelet.conf file ownership is set to root:root.\n",
+        "rationale": "The kubelet.conf file is the kubeconfig file for the node, and controls various parameters\nthat set the behavior and identity of the worker node. You should set its file ownership to\nmaintain the integrity of the file. The file should be owned by root:root.\n",
+        "audit": "Automated AAC auditing has been modified to allow CIS-CAT to input a variable for the / of\nthe kubelet config file.\nPlease set $kubelet_config= based on the file location on your system\nfor example:\n`export kubelet_config=/etc/kubernetes/kubelet.conf`\nTo perform the audit manually:\nRun the below command (based on the file location on your system) on the each worker\nnode. For example, ``` stat -c %U %G /etc/kubernetes/kubelet.conf ``` Verify that the ownership is set to `root:root`.\n",
+        "remediation": "Run the below command (based on the file location on your system) on the\neach worker node. For example, ``` chown root:root /etc/kubernetes/kubelet.conf ```\n",
+        "impact": "None\n",
+        "default_value": "By default, `kubelet.conf` file ownership is set to `root:root`.\n",
+        "references": "1. https://kubernetes.io/docs/admin/kubelet/\n",
+        "section": "Worker Node Configuration Files",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 4.1.6",
+            "Worker Node Configuration Files"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_4_1_6"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "8dad2026-5cfd-5398-ba90-9c329ae6b2ca",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "8dad2026-5cfd-5398-ba90-9c329ae6b2ca",
+        "name": "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)",
+        "profile_applicability": "* Level 2 - Worker Node\n",
+        "description": "Security relevant information should be captured. \nThe `--event-qps` flag on the Kubelet can be used to limit the rate at which events are gathered.\nSetting this too low could result in relevant events not being logged, however the unlimited setting of `0` could result in a denial\nof service on the kubelet.\n",
+        "rationale": "It is important to capture all events and not restrict event creation. \nEvents are an important source of security information and analytics that ensure that your environment is\nconsistently monitored using the event data.\n",
+        "audit": "Run the following command on each node:\n```\nps -ef | grep kubelet\n```\nReview the value set for the `--event-qps` argument and determine whether this has been\nset to an appropriate level for the cluster. The value of `0` can be used to ensure that all\nevents are captured.\nIf the `--event-qps` argument does not exist, check that there is a Kubelet config file\nspecified by `--config` and review the value in this location.\n",
+        "remediation": "If using a Kubelet config file, edit the file to set `eventRecordQPS:` to an appropriate level.\nIf using command line arguments, edit the kubelet service file\n`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and\nset the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.\nBased on your system, restart the `kubelet` service. \nFor example:\n```\nsystemctl daemon-reload\nsystemctl restart kubelet.service\n```\n",
+        "impact": "Setting this parameter to `0` could result in a denial of service condition due to excessive\nevents being created. The cluster's event processing and storage systems should be scaled\nto handle expected event loads.\n",
+        "default_value": "By default, `--event-qps` argument is set to `5`.\n",
+        "references": "1. https://kubernetes.io/docs/admin/kubelet/\n2. https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go\n",
+        "section": "Kubelet",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 4.2.9",
+            "Kubelet"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_4_2_9"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "95868b0f-4f1a-5af1-846e-93725abc9c18",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "95868b0f-4f1a-5af1-846e-93725abc9c18",
+        "name": "Ensure that the admission control plugin AlwaysPullImages is set(Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "Always pull images.\n",
+        "rationale": "Setting admission control policy to AlwaysPullImages forces every new pod to\npull the required images every time. In a multi-tenant cluster users can be assured that their\nprivate images can only be used by those who have the credentials to pull them. \nWithout this admission control policy, once an image has been pulled to a node, any pod from any\nuser can use it simply by knowing the image’s name, without any authorization check\nagainst the image ownership. When this plug-in is enabled, images are always pulled prior\nto starting containers, which means valid credentials are required.\n",
+        "audit": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--enable-admission-plugins` argument is set to a value that includes\n`AlwaysPullImages`.\n",
+        "remediation": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml \non the Control Plane node and set the `--enable-admission-plugins` parameter to include `AlwaysPullImages`. ``` --enable-admission-plugins=...,AlwaysPullImages,... ```\n",
+        "impact": "Credentials would be required to pull the private images every time. Also, in trusted\nenvironments, this might increases load on network, registry, and decreases speed.\nThis setting could impact offline or isolated clusters, which have images pre-loaded and do\nnot have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration.\n",
+        "default_value": "By default, AlwaysPullImages is not set.\n",
+        "references": "1. https://kubernetes.io/docs/admin/kube-apiserver/\n2. https://kubernetes.io/docs/admin/admission-controllers/#alwayspullimages\n",
+        "section": "API Server",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.2.12",
+            "API Server"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_2_12"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "9ad692c7-e8ee-5633-ac83-d7911467c2c0",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "9ad692c7-e8ee-5633-ac83-d7911467c2c0",
+        "name": "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "The `SecurityContextDeny` admission controller can be used to deny pods which make use of\nsome SecurityContext fields which could allow for privilege escalation in the cluster. \nThis should be used where PodSecurityPolicy is not in place within the cluster.\n",
+        "rationale": "`SecurityContextDeny` can be used to provide a layer of security for clusters which do not\nhave PodSecurityPolicies enabled.\n",
+        "audit": "Run the following command on the Control Plane node:\n  \n``` ps -ef | grep kube-apiserver ```\nVerify that the `--enable-admission-plugins` argument is set to a value that includes\n`SecurityContextDeny`, if `PodSecurityPolicy` is not included.\n",
+        "remediation": "Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` \non the Control Plane node and set the `--enable-admission-plugins` parameter to include `SecurityContextDeny`, \nunless `PodSecurityPolicy` is already in place.\n`--enable-admission-plugins=...,SecurityContextDeny,...`\n",
+        "impact": "This admission controller should only be used where Pod Security Policies cannot be used\non the cluster, as it can interact poorly with certain Pod Security Policies\n",
+        "default_value": "By default, `SecurityContextDeny` is not set.\n",
+        "references": "1. https://kubernetes.io/docs/admin/kube-apiserver/\n2. https://kubernetes.io/docs/admin/admission-controllers/#securitycontextdeny\n3. https://kubernetes.io/docs/user-guide/pod-security-policy/#working-with-rbac\n",
+        "section": "API Server",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.2.13",
+            "API Server"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_2_13"
+    }
+}
@@ -0,0 +1,31 @@
+{
+    "id": "d44fc5e7-7275-5d07-88a7-f1f8fc2f73c2",
+    "type": "csp-rule-template",
+    "attributes": {
+        "id": "d44fc5e7-7275-5d07-88a7-f1f8fc2f73c2",
+        "name": "Ensure that the admission control plugin EventRateLimit is set (Manual)",
+        "profile_applicability": "• Level 1 - Master Node\n",
+        "description": "Limit the rate at which the API server accepts requests.\n",
+        "rationale": "Using `EventRateLimit` admission control enforces a limit on the number of events that the\nAPI Server will accept in a given time slice. A misbehaving workload could overwhelm and\nDoS the API Server, making it unavailable. This particularly applies to a multi-tenant\ncluster, where there might be a small percentage of misbehaving tenants which could have\na significant impact on the performance of the cluster overall. Hence, it is recommended to\nlimit the rate of events that the API server will accept.\nNote: This is an Alpha feature in the Kubernetes 1.15 release.\n",
+        "audit": "Run the following command on the Control Plane node: ``` ps -ef | grep kube-apiserver ``` Verify that the `--enable-admission-plugins` argument is set to a value that includes `EventRateLimit`.\n",
+        "remediation": "Follow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` \nand set the below parameters. ``` --enable-admission-plugins=...,EventRateLimit,...\n--admission-control-config-file=\u003cpath/to/configuration/file\u003e ```\n",
+        "impact": "You need to carefully tune in limits as per your environment.\n",
+        "default_value": "By default, `EventRateLimit` is not set.\n",
+        "references": "1. https://kubernetes.io/docs/admin/kube-apiserver/\n2. https://kubernetes.io/docs/admin/admission-controllers/#eventratelimit\n3. https://github.com/staebler/community/blob/9873b632f4d99b5d99c38c9b15fe2f\n8b93d0a746/contributors/design-\nproposals/admission_control_event_rate_limit.md\n",
+        "section": "API Server",
+        "version": "1.0",
+        "tags": [
+            "CIS",
+            "Kubernetes",
+            "CIS 1.2.10",
+            "API Server"
+        ],
+        "benchmark": {
+            "name": "CIS Kubernetes V1.23",
+            "version": "v1.0.0"
+        },
+        "enabled": true,
+        "muted": false,
+        "rego_rule_id": "cis_1_2_10"
+    }
+}