Verify Permissions on the Etcd Write-Ahead-Log Files
An XCCDF Rule
Description
To properly set the permissions of /var/lib/etcd/member/wal/*, run the command:
$ sudo chmod 0600 /var/lib/etcd/member/wal/*
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Etcd service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
etcd is a highly-available key-value store used by Kubernetes deployments for persistent storage of all of its REST API objects. This data directory should be protected from any unauthorized reads or writes. It should not be readable or writable by any group members or the world.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_etcd_data_files
- Severity
- Medium
- References
- Updated