SSH must not run within Linux containers for Docker Enterprise.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95641	DKER-EE-001970	SV-104779r1_rule		Medium

Description
SSH server should not be running within the container. The user should instead use Universal Control Plane (UCP) to console in to running containers. Running SSH within the container increases the complexity of security management by making it: - Difficult to manage access policies and security compliance for SSH server - Difficult to manage keys and passwords across various containers - Difficult to manage security upgrades for SSH server - It is possible to have shell access to a container without using SSH, the needlessly increasing the complexity of security management should be avoided By default, SSH server is not running inside the container. Only one process per container is allowed.

Description

SSH server should not be running within the container. The user should instead use Universal Control Plane (UCP) to console in to running containers. Running SSH within the container increases the complexity of security management by making it: - Difficult to manage access policies and security compliance for SSH server - Difficult to manage keys and passwords across various containers - Difficult to manage security upgrades for SSH server - It is possible to have shell access to a container without using SSH, the needlessly increasing the complexity of security management should be avoided By default, SSH server is not running inside the container. Only one process per container is allowed.

STIG	Date
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide	2019-09-13

Details

Check Text ( C-94469r1_chk )
This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster. Verify that no running containers have a process for SSH server. via CLI: for i in $(docker ps -qa); do echo $i; docker exec $i ps -el \| grep -i sshd;done Container not running errors are not a finding. If running containers have a process for SSH server, this is a finding.

Check Text ( C-94469r1_chk )

This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.

Verify that no running containers have a process for SSH server.

via CLI:

for i in $(docker ps -qa); do echo $i; docker exec $i ps -el | grep -i sshd;done

Container not running errors are not a finding.

If running containers have a process for SSH server, this is a finding.

Fix Text (F-101307r1_fix)
This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster. Remove SSH packages from all Docker base images in use in the user's environment.