Use MLPS security hardening for ACK based on Alibaba Cloud Linux - Container Service for Kubernetes

ACK provides MLPS 2.0 Level 3 based on Alibaba Cloud Linux. You can enable MLPS security hardening for a node pool and configure a baseline check policy. ACK automatically configures security hardening items for the cluster and runs MLPS compliance baseline checks to ensure that the operating system meets MLPS requirements.

Compliance requirements met by MLPS security hardening

According to the operating system requirements specified in the GB/T 22239-2019 Information Security Technology—Baseline for Classified Protection of Cybersecurity, ACK implements MLPS 2.0 Level 3 based on Alibaba Cloud Linux. You can enable the MLPS security hardening feature to meet the following compliance requirements.

identity authentication
access control
security audit
intrusion prevention
malware prevention

Check rules for Alibaba Cloud Linux MLPS 2.0 Level 3 images

Alibaba Cloud Linux MLPS 2.0 Level 3 images are hardened according to GB/T 22239-2019. The following table details the corresponding check items.

Item type	Item name	Description
identity authentication	Identify and authenticate logon users. User identities must be unique. Authentication credentials must meet complexity requirements and be changed periodically.	Check for accounts with empty passwords. Ensure that user IDs (UIDs) are unique. Set password complexity requirements. Change passwords periodically. Set a minimum time interval for password changes to prevent unauthorized users from changing passwords multiple times in a short period. Restrict password reuse. Ensure that root is the only account with a UID of 0.
	Secure remote management connections to prevent network interception of authentication information.	Check whether SSHD is configured to enforce the SSHv2 protocol. Disable insecure remote connection services, such as Telnet.
	Provide a logon failure handling feature that includes session termination, limits on failed logon attempts, and automatic logout after a timeout.	Check whether a logon failure lockout policy is configured, an idle session timeout is set, and automatic disconnection is enabled after a logon timeout.
access control	Assign accounts and permissions to logon users.	In addition to system administrators, assign accounts for regular users, auditors, and security personnel. Ensure that the user umask is set to 027 or stricter. Ensure that the permissions for each user's home directory are set to 750 or stricter.
	Rename or delete default accounts and change their default passwords.	Do not delete the root account on Linux. Instead, check whether direct SSH logon as the root user is disabled. Disable logon (non-login) for default system and database accounts other than root. Ensure that no weak passwords exist and that the corresponding weak password baseline check is passed.
	Access control granularity is at the user or process level for subjects and the file or database table level for objects.	Check whether the permissions of important files, such as access control configuration files and user permission configuration files, are at the user-level granularity.
	Promptly delete or disable redundant and expired accounts. Avoid using shared accounts.	Disable logon (non-login) for default system and database accounts other than root. Lock or delete the shutdown and halt accounts.
	Grant administrative users the minimum permissions required and separate the permissions of administrative users.	Ensure that access to the su command is restricted. Check the /etc/sudoers file for users who have sudo permissions. Configure sudo permissions for non-root users as needed. Do not grant ALL permissions to any user except administrators.
	An authorized entity must configure the access control policy. The policy must specify the rules for subject access to objects.	Ensure that the permissions for each user's home directory are set to 750 or stricter. Reset the ownership of orphan files or folders to an active user on the system as needed. Set the permissions and ownership of the SSH host public key files. Set the permissions and ownership of the SSH host private key files.
security audit	Protect audit records and back them up regularly to prevent accidental deletion, modification, or overwriting.	Check the auditd file size and log rotation configuration, or check whether logs are backed up to a log server. If automatic remediation fails, you must first resolve the check item for enabling the security audit feature.
	Audit records must include the event date and time, user, event type, event outcome (success or failure), and other audit-related information.	This requirement is satisfied if the security audit feature is enabled.
	Enable the security audit feature. The audit must cover every user and record important user behaviors and security events.	Enable the auditd service. Enable the rsyslog or syslog-ng service. Ensure that file deletion events by users are collected. Ensure that changes to the system administration scope (sudoers) are collected. Ensure that events related to modifying user or group information are collected. If you use a third-party log collection service, you can provide your own proof and ignore this item.
	Protect audit processes from unexpected interruptions.	The auditd process is the daemon for the audit process, and the syslogd process is the daemon for the syslog process. Check whether these system processes are running.
intrusion prevention	Discover known vulnerabilities and patch them in a timely manner after thorough testing and evaluation.	Security Center's vulnerability detection and remediation features meet this requirement. If you use other methods, you can provide proof and ignore this item.
	Follow the principle of minimal installation and install only required components and applications.	For Alibaba Cloud Linux 3: Uninstall software such as avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind. For Alibaba Cloud Linux 2: Uninstall software such as NetworkManager, avahi-daemon, Bluetooth, firstboot, Kdump, wdaemon, wpa_supplicant, and ypbind.
	Disable unnecessary system services, default shares, and high-risk ports.	Disable unnecessary system services and file sharing services. Close high-risk ports such as 21, 23, 25, 111, 427, and 631. If you use a strict access control policy to secure these services and ports due to special requirements, you can provide your own proof and ignore this item.
	Detect intrusions on important nodes and provide alerts for critical intrusion events.	The intrusion detection and alert features of Security Center can meet this requirement. If you use other detection and alert methods, you can provide your own proof and ignore this item.
	Restrict remote management terminals by connection type or network address range.	For Alibaba Cloud Linux 3: Based on the terminals that you want to allow to connect, edit the /etc/ssh/sshd_config file. Set the `AllowUsers <user>@<host>` parameter as required. Note `<user>` specifies the username that is allowed to log on to the server. `<host>` specifies the IP address of the server. Replace them as required. After editing, press `Esc`, enter `:wq`, and press Enter to save and exit. Run the `sudo systemctl restart sshd` command to restart the sshd service. For Alibaba Cloud Linux 2: The /etc/hosts.allow file specifies the IP addresses that are allowed to connect to the host. It must not be set to `ALL:ALL`. The /etc/hosts.deny file specifies the IP addresses that are prohibited from connecting to the host. It must be set to `ALL:ALL` to deny all connections by default. These files work in tandem, and the `/etc/hosts.allow` rule is processed first. If you implemented this restriction by using other methods, such as security groups or firewalls, you can provide your own proof and ignore this item.
malware prevention	For Alibaba Cloud Linux 3: Use technical measures to protect against malware attacks, or use an active immune-based trusted verification mechanism to promptly identify and block intrusions and virus behaviors. For Alibaba Cloud Linux 2: Install anti-malware software and promptly update the software version and malware signature database.	Check whether Security Center is installed and used. If you have installed other anti-malware software, you can provide your own proof and ignore this item.

Use Alibaba Cloud Linux MLPS 2.0 Level 3

When you create an ACK cluster, you can enable MLPS Security Hardening. ACK automatically configures security hardening items for the cluster to meet the operating system requirements specified in GB/T 22239-2019.

Important

To meet the requirements of MLPS 2.0 Level 3, ACK creates three regular users (ack_admin, ack_audit, and ack_security) by default in the hardened Alibaba Cloud Linux.
To meet the requirements of MLPS 2.0 Level 3, the hardened Alibaba Cloud Linux prohibits root logon over SSH. You can log on to the ECS console to connect to an instance by using VNC and create a regular user that can use SSH.

Configure a baseline check policy

This section describes how to configure and run an MLPS-compliant baseline check on ECS instances, using Alibaba Cloud Linux 3 as an example.

Prerequisites

You must have a Security Center edition that supports baseline checks. For more information, see Purchase Security Center. The baseline check feature varies based on the edition of Security Center that you use. For more information, see Features.

Procedure

Log on to the Security Center console.
In the upper-right corner of the Risk Governance > CSPM page, click Policy.
On the Policy panel, click the Baseline Check Policy tab to configure a compliant baseline check policy as required.
- Set the baseline check coverage level.
  
  You can select one or more risk levels: High, medium, and Low. This configuration applies to all check policies.
- Click Create Standard Policy. On the Baseline Check Policy panel, complete the configuration and click OK. The following section describes only the key parameters. For more information, see Baseline check.
  - Policy Name: Enter a name for the policy, such as Alibaba Cloud Linux 3 MLPS Compliance Check. Select a Detection Cycle and a Check Start Time.
  - Baseline Name: Search for and select MLPS Level 3 - Alibaba Cloud Linux 3 Compliance Baseline.
  - Scan Method: Select a scan method for the servers. Valid values:
    - Group: Scans servers by asset group. You can only select all servers in one or more groups.
    - ECS: Scans servers by ECS instance. You can select some or all servers from different groups.
  - Effective Server: Select the asset groups to which you want to apply the policy. Newly purchased servers are added to the Ungrouped group. To apply this policy to new assets, select Ungrouped.
After you configure the check policy, you can also click Edit or Delete in the Actions column for the policy to modify or delete it based on your business requirements.

Note
A deleted policy cannot be recovered. You cannot delete a default policy or modify its baseline check items. You can modify only the check start time and the servers to which the default policy applies.
Run the baseline check policy.

On the Risk Governance > CSPM page, click the System Baseline Risks tab. On the Baseline Check Policy tab, click the icon to expand the policy, select the configured MLPS-compliant baseline check policy, and then click Check Now in the Check Item Scan section on the right.

After you run the check policy, the Check Now button is disabled until the scan is complete. After the baseline check is complete, go to the System Baseline Risks > Risk Level tab to view the failed check items and their details, and promptly fix the failed check items. For more information, see View and handle baseline risks.