STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 13 Apr 2021:

Kubernetes Kubelet must not disable timeouts.

DISA Rule

SV-242416r712604_rule

Vulnerability Number

V-242416

Group Title

SRG-APP-000516-CTR-001325

Rule Version

CNTR-K8-001300

Severity

CAT II

CCI(s)

• CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the Kubernetes Master Node. Set the argument "--streaming-connection-idle-timeout" to a value other than "0". Reset Kubelet service using the following command:

service kubelet restart

Check Contents

Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run the command:

grep -i streaming-connection-idle-timeout kubelet

If the setting streaming-connection-idle-timeout is set to "0" or the parameter is not configured in the Kubernetes Kubelet, this is a finding.

Vulnerability Number

V-242416

Documentable

False

Rule Version

CNTR-K8-001300

Severity Override Guidance

Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run the command:

grep -i streaming-connection-idle-timeout kubelet

If the setting streaming-connection-idle-timeout is set to "0" or the parameter is not configured in the Kubernetes Kubelet, this is a finding.

Check Content Reference

M

Target Key

5376

Comments