Verify Permissions on the Worker Certificate Authority File
An XCCDF Rule
Description
To properly set the permissions of /etc/kubernetes/kubelet-ca.crt
, run the command:
$ sudo chmod 0644 /etc/kubernetes/kubelet-ca.crt
Rationale
If the worker certificate authority file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the certificate authority certificate for an OpenShift node that is configured on the system. Protection of this file is critical for OpenShift security.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_worker_ca
- Severity
- Medium
- References
- Updated