Verify Group Who Owns The Etcd Write-Ahead-Log Files
An XCCDF Rule
Description
To properly set the group owner of /var/lib/etcd/member/wal/*, run the command:
$ sudo chgrp root /var/lib/etcd/member/wal/*
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Etcd service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_etcd_data_files
- Severity
- Medium
- References
- Updated