STIGQter: STIG Summary: Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling.

DISA Rule

SV-235788r627491_rule

Vulnerability Number

V-235788

Group Title

SRG-APP-000131

Rule Version

DKER-EE-001770

Severity

CAT III

CCI(s)

• CCI-001749 - The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc.

When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows:

docker.io/docker/ucp:[ucp_version]
docker.io/docker/dtr:[dtr_version]

If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows:

https://docs.docker.com/ee/ucp/admin/install/install-offline/
https://docs.docker.com/ee/dtr/admin/install/install-offline/

Check Contents

For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc.

Execute the following command to validate the Docker image signature digests of UCP and DTR:

docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version]

Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.

Vulnerability Number

V-235788

Documentable

False

Rule Version

DKER-EE-001770

Severity Override Guidance

For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc.

Execute the following command to validate the Docker image signature digests of UCP and DTR:

docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version]

Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.

Check Content Reference

M

Target Key

5281

Comments