| name | cis-k8s-v1120-1.2.29 |
| description | Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) |
| category | cis-k8s |
| version | 1.12.0 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","control-plane","api-server","tls","cipher-suites","cryptography"] |
| cis_id | 1.2.29 |
| cis_benchmark | CIS Kubernetes Benchmark v1.12.0 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
1.2.29 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)
Profile Applicability
Description
Ensure that the API server is configured to only use strong cryptographic ciphers.
Rationale
TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS cipher suites including some that have security concerns, weakening the protection provided.
Impact
API server clients that cannot support modern cryptographic ciphers will not be able to make connections to the API server.
Audit
Run the following command on the Control Plane node:
ps -ef | grep kube-apiserver
Verify that the --tls-cipher-suites argument is set as outlined in the remediation procedure below.
Remediation
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the below parameter.
--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
Default Value
By default the Kubernetes API server supports a wide range of TLS ciphers
References
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
- https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites
Additional Information
Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_RC4_128_SHA.
CIS Controls
| Controls Version | Control | IG 1 |
|---|
