From d026e046f7d2b8ab0543bb7edaa16af26a67943d Mon Sep 17 00:00:00 2001
From: bjrara <bjrara@sina.com>
Date: Sun, 18 Oct 2020 23:08:19 +0800
Subject: [PATCH] Check tls-cipher-suites using valid_elements op (#739)
---
cfg/cis-1.5/master.yaml | 2 +-
cfg/cis-1.6/master.yaml | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/cfg/cis-1.5/master.yaml b/cfg/cis-1.5/master.yaml
index 3881fae..414f44e 100644
--- a/cfg/cis-1.5/master.yaml
+++ b/cfg/cis-1.5/master.yaml
@@ -908,7 +908,7 @@ groups:
test_items:
- flag: "--tls-cipher-suites"
compare:
- op: has
+ op: valid_elements
value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
set: true
remediation: |
diff --git a/cfg/cis-1.6/master.yaml b/cfg/cis-1.6/master.yaml
index 8f07ced..030ea1b 100644
--- a/cfg/cis-1.6/master.yaml
+++ b/cfg/cis-1.6/master.yaml
@@ -832,7 +832,7 @@ groups:
test_items:
- flag: "--tls-cipher-suites"
compare:
- op: has
+ op: valid_elements
value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
remediation: |
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
--
GitLab