開(kāi)頭語(yǔ)
寫在前面：如有問(wèn)題，以你為準(zhǔn)，
目前24年應(yīng)屆生，各位大佬輕噴，部分資料與圖片來(lái)自網(wǎng)絡(luò)
內(nèi)容較長(zhǎng)，頁(yè)面右上角目錄方便跳轉(zhuǎn)
CIS 介紹
問(wèn)題：下載pdf后，根據(jù)里面的基準(zhǔn)來(lái)檢查K8s集群配置，但內(nèi)容量太大，一般會(huì)采用相關(guān)工具來(lái)完成這項(xiàng)工作。
Kube-bench是容器安全廠商Aquq推出的工具，以CISK8s基準(zhǔn)作為基礎(chǔ)，來(lái)檢查K8s是否安全部署。
主要查找不安全的配置參數(shù)、敏感的文件權(quán)限、不安全的帳戶或公開(kāi)端口等等。
可以獲得各種操作系統(tǒng)的安全最佳實(shí)踐基準(zhǔn)
Kube-bench
GitHub - aquasecurity/kube-bench: Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark
[root@master kube-bench]# ls
kube-bench_0.6.12_linux_amd64.tar.gz
[root@master kube-bench]# tar -xvf kube-bench_0.6.12_linux_amd64.tar.gz
cfg/ack-1.0/config.yaml
cfg/ack-1.0/controlplane.yaml
cfg/ack-1.0/etcd.yaml
...
[root@master kube-bench]# ls
cfg? kube-bench? kube-bench_0.6.12_linux_amd64.tar.gz
[root@master kube-bench]# cd cfg/
[root@master cfg]# ls
ack-1.0? cis-1.20? cis-1.24? cis-1.6????? config.yaml? eks-1.1.0???????????????? gke-1.0??? rh-0.7
aks-1.0? cis-1.23? cis-1.5?? cis-1.6-k3s? eks-1.0.1??? eks-stig-kubernetes-v1r6? gke-1.2.0? rh-1.0另創(chuàng)目錄
mkdir /etc/kube-bench
mv cfg? kube-bench? /etc/kube-bench/
[root@master kube-bench]# cd /etc/kube-bench/
[root@master kube-bench]# cp kube-bench /bin命令介紹
https://github.com/aquasecurity/kube-bench/blob/main/docs/platforms.md
[root@master cfg]# kube-bench help
This tool runs the CIS Kubernetes Benchmark (https://www.cisecurity.org/benchmark/kubernetes/)
Usage:
? kube-bench [flags]
? kube-bench [command]
Available Commands:
? completion? Generate the autocompletion script for the specified shell
? help??????? Help about any command
? run???????? Run tests
? version???? Shows the version of kube-bench.
Flags:
????? --alsologtostderr????????????????? log to standard error as well as files
...kube-bench run 常用參數(shù)：
-s,--targets 指定要基礎(chǔ)測(cè)試的目標(biāo)，這個(gè)目標(biāo)需要匹配cfg/<version>中的
文件名稱，已有目標(biāo)：master,controlplane,node,etcd,policies
--version: 指定k8s版本，如果未指定會(huì)自動(dòng)檢測(cè)
--benchmark:手動(dòng)指定CIS基準(zhǔn)版本，不能與--version一起使用
檢查源代碼
type 可以手動(dòng)設(shè)置來(lái)讓其跳過(guò)某一項(xiàng)檢測(cè)
手動(dòng)跳過(guò)某項(xiàng)檢測(cè)
--profiling 最新版本被棄用了
重新執(zhí)行檢測(cè)
匯總信息輸出
運(yùn)行原理
通過(guò) cfg 文件下的 cis-1.24 目錄中的yaml 進(jìn)行檢測(cè)（簡(jiǎn)單的配置比對(duì)）
cis-1.24是根據(jù)cis安全基準(zhǔn)來(lái)的
修復(fù)
檢測(cè) master
[root@master cfg]# ls
ack-1.0? cis-1.20? cis-1.24? cis-1.6????? config.yaml? eks-1.1.0???????????????? gke-1.0??? rh-0.7
aks-1.0? cis-1.23? cis-1.5?? cis-1.6-k3s? eks-1.0.1??? eks-stig-kubernetes-v1r6? gke-1.2.0? rh-1.0
[root@master cis-1.24]# ls
config.yaml? controlplane.yaml? etcd.yaml? master.yaml? node.yaml? policies.yaml
這些就是cis的手冊(cè)安全配置，通過(guò)這些配置進(jìn)行檢測(cè)集群[root@master cfg]# kube-bench run --targets=master
[INFO] 1 Control Plane Security Configuration
[INFO] 1.1 Control Plane Node Configuration Files
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)
[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)
[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)
[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)
[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)
[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)
[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)
[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)
[PASS] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)
....
== Remediations master ==
.....
== Summary master ==
40 checks PASS
9 checks FAIL
12 checks WARN
0 checks INFO
== Summary total ==
40 checks PASS
9 checks FAIL
12 checks WARN
0 checks INFO
[PASS]: 測(cè)試通過(guò)
[FAIL]: 測(cè)試未通過(guò)，重點(diǎn)關(guān)注，在測(cè)試結(jié)果會(huì)給出修復(fù)建議
[WARN]: 警告，可做了解
[INFO]: 信息決安全問(wèn)題
將沒(méi)有通過(guò)篩選出來(lái)
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
[FAIL] 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)
[FAIL] 1.2.17 Ensure that the --profiling argument is set to false (Automated)
[FAIL] 1.2.18 Ensure that the --audit-log-path argument is set (Automated)
[FAIL] 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)
[FAIL] 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)
[FAIL] 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)== Remediations master == # 下面就會(huì)有解決方法
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
from the command 'ps -ef | grep etcd'.
Run the below command (based on the etcd data directory found above).
For example, chown etcd:etcd /var/lib/etcd
[root@master cis-1.24]# ps -ef | grep etcd | grep data-dir
root??????? 3466??? 3420? 1 Feb23 ???????? 08:48:04 etcd --advertise-client-urls=https://192.168.100.53:2379 --cert-file=/etc/kubernetes/pki/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/etcd
[root@master cis-1.24]# ll /var/lib/etcd
total 0
drwx------. 4 root root 29 Feb? 2 07:11 member
# 注意etcd現(xiàn)在是pod部署，所有這個(gè)項(xiàng)安全不需要改
[FAIL] 1.2.17 Ensure that the --profiling argument is set to false (Automated)
1.2.17 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the below parameter.
--profiling=false# 配置文件進(jìn)行備份
[root@master manifests]# cp kube-apiserver.yaml kube-apiserver.yaml.bak
# 進(jìn)行修改添加字段
[root@master manifests]# vim kube-apiserver.yaml
spec:
? containers:
? - command:
??? - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
??? - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
??? - --enable-aggregator-routing=true
??? - --profiling=false #在最下添加這個(gè)字段
[root@master manifests]# systemctl restart kubelet
[root@master manifests]# kubectl get node
NAME???? STATUS?? ROLES?????????? AGE?? VERSION
master?? Ready??? control-plane?? 42d?? v1.26.1
node1??? Ready??? <none>????????? 42d?? v1.26.1
node2??? Ready??? <none>????????? 42d?? v1.26.1
# 再使用 kube-bench 進(jìn)行檢測(cè)，注意需要第一次可能還不通過(guò)，多執(zhí)行幾次
[root@master cfg]# kube-bench run --targets=master
[PASS] 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated)
# 如果沒(méi)成功是因?yàn)?bak文件在這個(gè)目錄下，不知道為什么kuberneter會(huì)識(shí)別bak結(jié)尾的文件
# 創(chuàng)建一個(gè)backup目錄，然后將備份的yaml移動(dòng)進(jìn)去，就解決了
# 原因：是不是全文件名匹配（強(qiáng)匹配），可能是kube-apiserver*這種，所以會(huì)導(dǎo)致在后面加.bak依舊被識(shí)別檢測(cè) node
需要將kube-bench也在node上使用，并將命令改為（node上執(zhí)行）文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-787611.html
./kube-bench run --targets node --benchmark cis-1.24文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-787611.html
到了這里，關(guān)于kubernetes CIS 安全基準(zhǔn) Kube-bench 安全工具的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
