| name | cis-eks-v170-3.2.1 |
| description | Ensure that the Anonymous Auth is Not Enabled (Automated) |
| category | cis-eks |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","eks","kubernetes","aws","worker-node","kubelet","authentication","anonymous-auth"] |
| cis_id | 3.2.1 |
| cis_benchmark | CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.7.0 |
| tech_stack | ["kubernetes","aws","eks"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
3.2.1 Ensure that the Anonymous Auth is Not Enabled (Automated)
Profile Applicability
Description
Disable anonymous requests to the Kubelet server.
Rationale
When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. You should rely on authentication to authorize access and disallow anonymous requests.
This configuration might have a slight impact on usability for users who rely on anonymous access for certain functions or quick troubleshooting. Additionally, there might be a minimal performance overhead due to the added authentication steps for each request.
Audit Procedure
Audit Method 1:
Kubelets can accept configuration via a configuration file and in some cases via command line arguments. It is important to note that parameters provided as command line arguments will override their counterpart parameters in the configuration file (see --config details in the Kubelet CLI Reference for more info).
With this in mind, it is important to check for the existence of command line arguments as well as configuration file entries when auditing Kubelet configuration.
Firstly, SSH to each node and execute the following command to find the Kubelet process:
ps -ef | grep kubelet
The output of the above command provides details of the active Kubelet process, from which we can see the command line arguments provided to the process. Also note the location of the configuration file, provided with the --config argument, as this will be needed to verify configuration. The file can be viewed with a command such as more or less, like so:
sudo less /path/to/kubelet-config.json
Verify that Anonymous Authentication is not enabled. This may be configured as a command line argument to the kubelet service with --anonymous-auth=false or in the kubelet configuration file via "authentication": { "anonymous": { "enabled": false } }.
Audit Method 2:
It is also possible to review the running configuration of a Kubelet via the /configz endpoint of the Kubernetes API. This can be achieved using kubectl to proxy your requests to the API.
Discover all nodes in your cluster by running the following command:
kubectl get nodes
Next, initiate a proxy with kubectl on a local port of your choice. In this example we will use 8080:
