mitre / docker-ce-cis-baseline

CIS Docker Community Edition Benchmark InSpec Profile

docker-ce-cis-baseline

InSpec profile to validate the secure configuration of Docker Community Edition, against CIS' Docker Community Edition Benchmark v1.1.0.

Getting Started

It is intended and recommended that InSpec run this profile from a "runner" host (such as a DevOps orchestration server, an administrative management system, or a developer's workstation/laptop) against the target remotely over winrm.

For the best security of the runner, always install on the runner the latest version of InSpec and supporting Ruby language components.

The latest versions and installation options are available at the InSpec site.

Tailoring to Your Environment

The following inputs must be configured in an inputs ".yml" file for the profile to run correctly for your specific environment. More information about InSpec inputs can be found in the InSpec Profile Documentation.

- Trusted system user
trusted_user: vagrant

- Number of managable docker containers
managable_container_number: 25

- Docker registry cert path
registry_cert_path: /etc/docker/certs.d

- Directory contain certificate certain Docker registry. cis-docker-benchmark-3.7
registry_name: /etc/docker/certs.d/registry_hostname:port

- Certificate file for a certain Docker registry certificate files. cis-docker-benchmark-3.7 and cis-docker-benchmark-3.8
registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt

- Docker container user
container_user: vagrant

- Docker container cap add
container_capadd: null

- Authorization plugin
authorization_plugin: authz-broker

- Log driver
log_driver: syslog

- Log Opts
log_opts: /syslog-address/

- App armor profile
app_armor_profile: docker-default

- SElinux profile
selinux_profile: /label\:level\:s0-s0\:c1023/

Running This Baseline Directly from Github

# How to run
inspec exec https://github.com/mitre/docker-ce-cis-baseline/archive/master.tar.gz -t winrm://<hostip> --user '<admin-account>' --password=<password> --input-file=<path_to_your_inputs_file/name_of_your_inputs_file.yml> --reporter=cli json:<path_to_your_output_file/name_of_your_output_file.json>

Different Run Options

Full exec options

Running This Baseline from a local Archive copy

If your runner is not always expected to have direct access to GitHub, use the following steps to create an archive bundle of this baseline and all of its dependent tests:

(Git is required to clone the InSpec profile using the instructions below. Git can be downloaded from the Git site.)

When the "runner" host uses this profile baseline for the first time, follow these steps:

mkdir profiles
cd profiles
git clone https://github.com/mitre/docker-ce-cis-baseline
inspec archive docker-ce-cis-baseline
inspec exec <name of generated archive> -t winrm://<hostip> --user '<admin-account>' --password=<password> --input-file=<path_to_your_inputs_file/name_of_your_inputs_file.yml> --reporter=cli json:<path_to_your_output_file/name_of_your_output_file.json>

For every successive run, follow these steps to always have the latest version of this baseline:

cd docker-ce-cis-baseline
git pull
cd ..
inspec archive docker-ce-cis-baseline --overwrite
inspec exec <name of generated archive> -t winrm://<hostip> --user '<admin-account>' --password=<password> --input-file=<path_to_your_inputs_file/name_of_your_inputs_file.yml> --reporter=cli json:<path_to_your_output_file/name_of_your_output_file.json>

Using Heimdall for Viewing the JSON Results

The JSON results output file can be loaded into heimdall-lite for a user-interactive, graphical view of the InSpec results.

The JSON InSpec results file may also be loaded into a full heimdall server, allowing for additional functionality such as to store and compare multiple profile runs.

Authors

• Mohamed El-Sharkawi - HackerShark
• Alicia Sturtevant - asturtevant

Special Thanks

• Aaron Lippold - aaronlippold
• Shivani Karikar - karikarshivani

Contributing and Getting Help

To report a bug or feature request, please open an issue.

NOTICE

© 2018-2020 The MITRE Corporation.

Approved for Public Release; Distribution Unlimited. Case Number 18-3678.

NOTICE

MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.

NOTICE

This software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.

No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.

For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, [phone].

NOTICE

CIS Benchmarks are published by the Center for Internet Security (CIS), see: https://www.cisecurity.org/.

docker-ce-cis-baseline's Issues

Update the inspec.yml file to be in line with the data in the README.md file prior to release

#5 is affected as well

The transplanted controls use the old audit_rules resources

Update the resources to use Jen's new audit resource to remove depreciation errors

InSpec Check warnings

The following warnings were found when running inspec check:

Add sample data

Add sample data folder with hardened and unhardened results

Attributes were not copied over with the controls

CHANGELOG.md:- use new InSpec attributes [\#10](https://github.com/dev-sec/cis-docker-benchmark/pull/10) ([chris-rock](https://github.com/chris-rock))
CHANGELOG.md:- determine attribute values at the beginning [\#1](https://github.com/dev-sec/cis-docker-benchmark/pull/1) ([chris-rock](https://github.com/chris-rock))
README.md:We use a yml attribute file to steer the configuration, the following options are available:
README.md:# run profile on remote host via SSH with sudo and define attribute value
README.md:inspec exec cis-docker-benchmark --attrs sample_attributes.yml
controls/container_images.rb:# attributes
controls/container_images.rb:CONTAINER_USER = attribute(
controls/container_runtime.rb:# attributes
controls/container_runtime.rb:CONTAINER_CAPADD = attribute(
controls/container_runtime.rb:APP_ARMOR_PROFILE = attribute(
controls/container_runtime.rb:SELINUX_PROFILE = attribute(
controls/docker_daemon_configuration.rb:# attributes
controls/docker_daemon_configuration.rb:DAEMON_TLSCACERT = attribute(
controls/docker_daemon_configuration.rb:DAEMON_TLSCERT = attribute(
controls/docker_daemon_configuration.rb:DAEMON_TLSKEY = attribute(
controls/docker_daemon_configuration.rb:AUTHORIZATION_PLUGIN = attribute(
controls/docker_daemon_configuration.rb:LOG_DRIVER = attribute(
controls/docker_daemon_configuration.rb:LOG_OPTS = attribute(
controls/docker_daemon_configuration.rb:SWARM_MODE = attribute(
controls/docker_daemon_configuration.rb:SWARM_MAX_MANAGER_NODES = attribute(
controls/docker_daemon_configuration.rb:SWARM_PORT = attribute(
controls/docker_daemon_configuration_files.rb:# attributes
controls/docker_daemon_configuration_files.rb:REGISTRY_CERT_PATH = attribute(
controls/docker_daemon_configuration_files.rb:REGISTRY_NAME = attribute(
controls/docker_daemon_configuration_files.rb:REGISTRY_CA_FILE = attribute(
controls/host_configuration.rb:TRUSTED_USER = attribute(
controls/host_configuration.rb:MANAGEABLE_CONTAINER_NUMBER = attribute(```

Clean up controls formatting so they are not so ugly to read and display.

Your editor should perhaps be able to help with this. Don't really want to have to 'hand clean' this but we will have work through that issue.

Update the README.md with all the needed information for release and attributions to dev-sec and CIS

• formal description of the profile from CIS
• provide instructions on the attributes
• example use and any known issues
• Provide links and attributions to dev-sec, @attomic111 and CIS for their indirect and direct contributions
• Any other data we think should be in our README.md

Added missing tests for new controls

rubocop issues found

The following rubocop issues were found:
rubocop.txt

Poplulate the `attributes.yml` file in the profile with all the attributes in the profile.

There should be at least two sections for the attribute files 'values':

If we think about this as the 'common data' where that data for the profile, I would guess there is a pattern like:

1. The 'commonly changed' attributes that for the most part folks would always have to edit.
2. The 'commonly unchanged' attributes that folks usually don't have to edit but are there given that we want to make all the controls and general as possible.
3. Perhaps a 'do not change' section if there are attributes ( this would usually be static set values but given we have attributes it is better form to use them than not to )

Update the way Attributes are handled

Attributes are populated in each control the old way we used to hanlde them. They should be updated and placed in the inspec.yml file. The controls currently affected by this are as follows:

1. M-1.4
2. M-2.6
3. M-2.11
4. M-2.12
5. M-3.7
6. M-3.8
7. M-4.1
8. M-5.1
9. M-5.2
10. M-5.3
11. M-5.8
12. M-6.2
13. M-7.1
14. M-7.2
15. M-7.3
16. M-7.4
17. M-7.5
18. M-7.6
19. M-7.7
20. M-7.8
21. M-7.9
22. M-7.10

Update the 'transplanted' controls to use the more current core resources

The current controls use a local resource called 'docker_helper'. I believe this can now be updated to use the more up to date 'docker' resource which was pushed to core.