Container Service for Kubernetes:Instructions for ACK MLPS 2.0 security hardening

Check item type

Check item name

Check content

Identity authentication

The identity of logon users must be authenticated and unique. Authentication information must meet complexity requirements and be changed periodically.

• Check for accounts with empty passwords.

• Ensure that user IDs (UIDs) are unique.

• Set password complexity requirements.

• Change passwords periodically.

• Set a minimum time interval for password changes to prevent unauthorized users from changing passwords multiple times in a short period.

• Restrict password reuse.

• Ensure that root is the only account with a UID of 0.

Necessary measures must be taken to prevent authentication information from being intercepted during network transmission when a server is managed remotely.

• Check whether SSHD is configured to use only the SSHv2 protocol.

• Disable insecure remote connection services such as Telnet.

A logon failure handling feature must be implemented. Measures such as session termination, limits on failed logon attempts, and automatic logout on connection timeout must be configured and enabled.

Check whether a logon failure lockout policy is configured, an idle session timeout is set, and the client is configured to disconnect after a logon timeout.

Access control

Assign accounts and permissions to logon users.

• In addition to system administrators, accounts must be assigned for regular users, auditors, and security administrators.

• Ensure that the user umask is 027 or stricter.

• Ensure that the permissions for each user's home directory are set to 750 or stricter.

Rename or delete default accounts and change their default security tokens.

• The root account in Linux cannot be deleted. Instead, check whether direct logon as the root user over the Secure Shell (SSH) protocol is disabled.

• Disable logon for default system accounts and database accounts other than root.

• Ensure that no weak passwords exist and that the weak password baseline check passes.

The granularity of access control must be at the user or process level for entities and at the file or database table level for objects.

Check whether the permissions of important files, such as access control and user permission configuration files, have user-level granularity.

Promptly delete or disable redundant or expired accounts. Avoid using shared accounts.

• Disable logon for default system accounts and database accounts other than root.

• Lock or delete the shutdown and halt accounts.

Grant administrative users the least privilege required and use permission separation.

• Ensure that access to the `su` command is restricted.

• Check the /etc/sudoers file for users with `sudo` permissions. If required, configure `sudo` permissions for users other than root. Do not grant `ALL` permissions to any user except the administrator.

An authorized entity must configure the access control policy, which specifies the rules for entity access to objects.

• Ensure that the permissions for each user's home directory are set to 750 or stricter.

• If required, reset the ownership of ownerless files or folders to an active user on the system.

• Set the permissions and ownership of the SSH host public key file.

• Set the permissions and ownership of the SSH host private key file.

Security audit

Audit records must be protected. They must be backed up periodically to prevent unexpected deletion, modification, or overwriting.

Check the `auditd` file size, log splitting configuration, or backup to a log server. If automatic repair fails, you must first fix the check item for enabling the security audit feature.

Audit records must include the date and time of the event, the user, the event type, the event outcome (success or failure), and other audit-related information.

This item is met if the check item for enabling the security audit feature is met.

The security audit feature must be enabled. The audit must cover every user and record important user behaviors and security events.

• Enable the auditd service.

• Enable the rsyslog or syslog-ng service.

• Ensure that file deletion events by users are collected.

• Ensure that changes to the system administration scope (sudoers) are collected.

• Ensure that events related to modifying user or group information are collected. If you use a third-party log collection service, you can provide evidence and ignore this item.

Audit processes must be protected from unexpected interruptions.

`auditd` is the daemon process for the `audit` process, and `syslogd` is the daemon process for the `syslog` process. Check whether these system processes are running.

Intrusion prevention

Known vulnerabilities must be detected. After thorough testing and evaluation, the vulnerabilities must be patched promptly.

The vulnerability detection and fixing features of Security Center can meet this requirement. If you use other methods, you can provide evidence and ignore this item.

Follow the principle of minimal installation by installing only necessary components and applications.

• Alibaba Cloud Linux 3: Uninstall software such as avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind.

• Alibaba Cloud Linux 2: Uninstall software such as NetworkManager, avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind.

Shut down unnecessary system services, default shares, and vulnerable ports.

• Shut down unnecessary system services and file sharing services.

• Close vulnerable ports such as 21, 23, 25, 111, 427, and 631.

• If you have special requirements that necessitate a strict access control policy, you can provide evidence and ignore this item.

Intrusions on important nodes must be detected, and alerts must be provided for critical intrusion events.

The intrusion detection and alerting features of Security Center can meet this requirement. If you have other detection and alerting methods, you can provide evidence and ignore this item.

Restrict management terminals that are managed over the network by setting the connection type or address range.

• Alibaba Cloud Linux 3:

  1. Edit the /etc/ssh/sshd_config file based on the configuration of the terminal used to log on to the server.

  2. Set the AllowUsers <user>@<host> parameter as required.

     Note

     <user> specifies the username for logging on to the server. <host> specifies the IP address of the server. Replace them as required.

  3. After you finish editing, press the Esc key, enter :wq, and then press the Enter key to save the file and exit.

  4. Run the sudo systemctl restart sshd command to restart the sshd service.

• Alibaba Cloud Linux 2:

  • The /etc/hosts.allow file specifies the IP addresses that are allowed to connect to the host. It must not be set to ALL:ALL.

  • The /etc/hosts.deny file specifies the IP addresses that are prohibited from connecting to the host. It must be set to ALL:ALL to deny all connections by default.

  The two files must be used together, and the /etc/hosts.allow rule must be configured first. If you implemented this restriction using other methods, such as security groups or firewalls, you can provide evidence and ignore this item.

Malware protection

• Alibaba Cloud Linux 3: Use technical measures to protect against malware attacks, or use an active immune-based trusted verification mechanism to promptly detect and block intrusions and virus behaviors.

• Alibaba Cloud Linux 2: Install anti-malware software and promptly update the software version and malware signature database.

Check whether Security Center is installed and used. If you have installed other anti-malware software, you can provide evidence and ignore this item.