القائمة
Ensure that the --token-auth-file parameter is not set (Manual)
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v160-1-2-3يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | cis-ocp-v160-1.2.3 |
| description | Ensure that the --token-auth-file parameter is not set (Manual) |
| category | cis-openshift |
| version | 1.6.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","control-plane","api-server","token-auth"] |
| cis_id | 1.2.3 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Do not use token based authentication.
The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication.
OpenShift does not use the token-auth-file flag. OpenShift includes a built-in OAuth server rather than relying on a static token file. The OAuth server is integrated with the API server.
OpenShift does not use the token-auth-file flag. OpenShift includes a built-in OAuth server rather than relying on a static token file. Authentication is managed by the OpenShift authentication-operator. To verify that the token-auth-file flag is not present and that the authentication-operator is running, run the following commands:
# Verify that the token-auth-file flag is not present
oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments'
oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments'
oc get kubeapiservers.operator.openshift.io cluster -o json | jq '.spec.observedConfig.apiServerArguments'
#Verify that the authentication operator is running
oc get clusteroperator authentication
Verify that the --token-auth-file argument does not exist.
Verify that the authentication-operator is running: Available is True.
None is required.
By default, --token-auth-file argument is not set and OAuth authentication is configured.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 4.6 Securely Manage Enterprise Assets and Software | x | x | x |
| v7 | 16.4 Encrypt or Hash all Authentication Credentials | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1078 | TA0001, TA0006 | M1043 |
Level 1 (Manual)