Skip to content

Commit 6a4f714

Browse files
rhmdndrhmdnd
committed
Add ITSAR NFV section 2 controls
This commit adds the rules for authentication attribute management (IAM-like) controls.
1 parent 3c4fd68 commit 6a4f714

1 file changed

Lines changed: 122 additions & 0 deletions

File tree

‎controls/itsar_nfv/section-2.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,3 +110,125 @@ controls:
110110
- configure_network_policies
111111
- configure_network_policies_namespaces
112112
- project_config_and_template_network_policy
113+
- id: '2.2'
114+
title: Authentication Attribute Management
115+
status: pending
116+
rules: []
117+
controls:
118+
- id: 2.2.1
119+
title: Authentication Policy
120+
status: partial
121+
notes: |-
122+
OpenShift delegates authentication to an external Identity
123+
Provider. The automated rules verify that an MFA-capable
124+
IdP is configured and that weak single-factor methods
125+
(htpasswd, basic-auth, static tokens) are disabled.
126+
However, actual MFA enforcement must be verified at the
127+
IdP level (e.g., Keycloak, Okta, Active Directory). For
128+
machine accounts, ServiceAccount tokens satisfy the
129+
single-attribute requirement.
130+
rules:
131+
- idp_is_configured
132+
- ocp_idp_no_htpasswd
133+
- kubeadmin_removed
134+
- ocp_no_ldap_insecure
135+
- api_server_token_auth
136+
- api_server_basic_auth
137+
- id: 2.2.2
138+
title: Authentication Support - External
139+
status: automated
140+
rules:
141+
- ocp_no_ldap_insecure
142+
- id: 2.2.3
143+
title: Protection against Brute Force and Dictionary Attacks
144+
status: partial
145+
notes: |-
146+
Brute force and dictionary attack protections are primarily
147+
enforced at the Identity Provider level. The automated rule
148+
ensures an IdP capable of account lockout is used instead of
149+
htpasswd. Verify that the external IdP is configured with at
150+
least two countermeasures such as account lockout after failed
151+
attempts, login delays, or password blacklists.
152+
rules:
153+
- ocp_idp_no_htpasswd
154+
- id: 2.2.4
155+
title: Enforce Strong Password
156+
status: partial
157+
notes: |-
158+
Password complexity is primarily enforced at the Identity
159+
Provider level. The automated rules ensure Kubernetes
160+
Secrets are encrypted at rest in etcd and that node-level
161+
password storage uses strong hashing. Verify that the
162+
external IdP enforces minimum length, character class,
163+
and password history requirements.
164+
rules:
165+
- api_server_encryption_provider_cipher
166+
- no_empty_passwords
167+
- id: 2.2.5
168+
title: Inactive Session Timeout
169+
status: automated
170+
rules:
171+
- oauth_inactivity_timeout
172+
- oauthclient_inactivity_timeout
173+
- oauth_or_oauthclient_inactivity_timeout
174+
- oauth_token_maxage
175+
- oauthclient_token_maxage
176+
- oauth_or_oauthclient_token_maxage
177+
- sshd_set_idle_timeout
178+
- sshd_set_keepalive
179+
- id: 2.2.6
180+
title: Password Changes
181+
status: manual
182+
notes: |-
183+
Password change enforcement, expiration, and history are
184+
functions of the external Identity Provider. Verify that
185+
the IdP linked to OpenShift enforces password changes on
186+
initial login and upon expiry, and prevents reuse of at
187+
least the last 3 passwords. Kubernetes does not track
188+
password history.
189+
rules: []
190+
- id: 2.2.7
191+
title: Protected Authentication Feedback
192+
status: inherently met
193+
notes: |-
194+
Password masking is inherent behavior in OpenShift and
195+
Linux. The OpenShift Console, oc CLI, and node-level
196+
authentication commands (passwd, login, sudo) all
197+
obscure password input using system calls that do not
198+
echo characters to the terminal. This cannot be
199+
misconfigured.
200+
rules: []
201+
- id: 2.2.8
202+
title: Removal of Predefined or Default Authentication Attributes
203+
status: automated
204+
rules:
205+
- kubeadmin_removed
206+
- id: 2.2.9
207+
title: Logout Function
208+
status: automated
209+
rules:
210+
- oauth_logout_url_set
211+
- id: 2.2.10
212+
title: Policy Regarding Consecutive Failed Login Attempts
213+
status: partial
214+
notes: |-
215+
Account lockout after failed login attempts is enforced
216+
at the Identity Provider level. The automated rule
217+
ensures an IdP capable of account lockout is used.
218+
Verify that the external IdP locks accounts after no
219+
more than 8 consecutive failed attempts, with a
220+
recommended default of 5.
221+
rules:
222+
- ocp_idp_no_htpasswd
223+
- id: 2.2.11
224+
title: Suspend Accounts on Non-Use
225+
status: partial
226+
notes: |-
227+
Account suspension after non-use is primarily managed
228+
by the external Identity Provider. The automated rule
229+
enforces account disabling on RHCOS nodes after
230+
password expiration inactivity. Verify that the IdP
231+
linked to OpenShift is configured to suspend accounts
232+
after a defined period without valid login.
233+
rules:
234+
- account_disable_post_pw_expiration

0 commit comments

Comments
 (0)