CyberStrikeus/CyberStrike - 第 41 页

cis-docker-v170-5-22

Ensure the default seccomp profile is not Disabled

原文语言：英语

cis-docker-v170-5-23

Ensure that docker exec commands are not used with the privileged option

原文语言：英语

cis-docker-v170-5-24

Ensure that docker exec commands are not used with the user=root option

原文语言：英语

cis-docker-v170-5-25

Ensure that cgroup usage is confirmed

原文语言：英语

cis-docker-v170-5-26

Ensure that the container is restricted from acquiring additional privileges

原文语言：英语

cis-docker-v170-5-27

Ensure that container health is checked at runtime

原文语言：英语

cis-docker-v170-5-28

Ensure that Docker commands always make use of the latest version of their image

原文语言：英语

cis-docker-v170-5-29

Ensure that the PIDs cgroup limit is used

原文语言：英语

cis-docker-v170-5-3

Ensure that, if applicable, SELinux security options are set

原文语言：英语

cis-docker-v170-5-30

Ensure that Docker's default bridge docker0 is not used

原文语言：英语

cis-docker-v170-5-31

Ensure that the host's user namespaces are not shared

原文语言：英语

cis-docker-v170-5-32

Ensure that the Docker socket is not mounted inside any containers

原文语言：英语

cis-docker-v170-5-4

Ensure that Linux kernel capabilities are restricted within containers

原文语言：英语

cis-docker-v170-5-5

Ensure that privileged containers are not used

原文语言：英语

cis-docker-v170-5-6

Ensure sensitive host system directories are not mounted on containers

原文语言：英语

cis-docker-v170-5-7

Ensure sshd is not run within containers

原文语言：英语

cis-docker-v170-5-8

Ensure privileged ports are not mapped within containers

原文语言：英语

cis-docker-v170-5-9

Ensure that only needed ports are open on the container

原文语言：英语

cis-docker-v170-6-1

Ensure that image sprawl is avoided

原文语言：英语

cis-docker-v170-6-2

Ensure that container sprawl is avoided

原文语言：英语

cis-docker-v170-7-1

Ensure that the minimum number of manager nodes have been created in a swarm

原文语言：英语

cis-docker-v170-7-2

Ensure that swarm services are bound to a specific host interface

原文语言：英语

cis-docker-v170-7-3

Ensure that all Docker swarm overlay networks are encrypted

原文语言：英语

cis-docker-v170-7-4

Ensure that Docker's secret management commands are used for managing secrets in a swarm cluster

原文语言：英语

cis-docker-v170-7-5

Ensure that swarm manager is run in auto-lock mode

原文语言：英语

cis-docker-v170-7-6

Ensure that the swarm manager auto-lock key is rotated periodically

原文语言：英语

cis-docker-v170-7-7

Ensure that node certificates are rotated as appropriate

原文语言：英语

cis-docker-v170-7-8

Ensure that CA certificates are rotated as appropriate

原文语言：英语

cis-docker-v170-7-9

Ensure that management plane traffic is separated from data plane traffic

原文语言：英语

cis-docker-3-1

Ensure that the docker.service file ownership is set to root:root

原文语言：英语

cis-docker-3-10

Ensure that TLS CA certificate file permissions are set to 444 or more restrictively

原文语言：英语

cis-docker-3-11

Ensure that Docker server certificate file ownership is set to root:root

原文语言：英语

cis-docker-3-12

Ensure that the Docker server certificate file permissions are set to 444 or more restrictively

原文语言：英语

cis-docker-3-13

Ensure that the Docker server certificate key file ownership is set to root:root

原文语言：英语

cis-docker-3-14

Ensure that the Docker server certificate key file permissions are set to 400

原文语言：英语

cis-docker-3-15

Ensure that the Docker socket file ownership is set to root:docker

原文语言：英语

cis-docker-3-16

Ensure that the Docker socket file permissions are set to 660 or more restrictively

原文语言：英语

cis-docker-3-17

Ensure that the daemon.json file ownership is set to root:root

原文语言：英语

cis-docker-3-18

Ensure that daemon.json file permissions are set to 644 or more restrictive

原文语言：英语

cis-docker-3-19

Ensure that the /etc/default/docker file ownership is set to root:root

原文语言：英语