>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

V-242393—Kubernetes Worker Nodes must not have sshd service running.

CAT II - Medium
CNTR-K8-000400

>Control Description

Worker Nodes are maintained and monitored by the Control Plane. Direct access and manipulation of the nodes should not take place by administrators. Worker nodes should be treated as immutable and updated via replacement rather than in-place upgrades.

>Check Content

Log in to each worker node. Verify that the sshd service is not running. To validate that the service is not running,

$systemctl status sshd

If the service sshd is active (running), this is a finding. Note: If console access is not available, SSH access can be attempted. If the worker nodes cannot be reached, this requirement is "not a finding".

>Remediation

To stop the sshd service,

$systemctl stop sshd Note:

If access to the worker node is through an SSH session, it is important to realize there are two requirements for disabling and stopping the sshd service and they should be done during the same SSH session. Disabling the service must be performed first and then the service stopped to guarantee both settings can be made if the session is interrupted.

>CCI References

CCI-000213

Control Correlation Identifiers (CCIs) map STIG findings to NIST 800-53 controls.

>Cross-Framework Mappings

NIST SP 800-53 r5

via DISA CCI List
AC-3
Compare

Ask AI

Configure your API key to use AI features.