OpenControls Logo

STIG Viewer

STIGViewer Support

Kubernetes API Server must disable basic authentication to protect information in transit.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-245542CNTR-K8-002620SV-245542r961632_ruleCCI-002448high
Description
Kubernetes basic authentication sends and receives request containing username, uid, groups, and other fields over a clear text HTTP communication. Basic authentication does not provide any security mechanisms using encryption standards. PKI certificate-based authentication must be set over a secure channel to ensure confidentiality and integrity. Basic authentication must not be set in the manifest file.
STIGDate
Kubernetes Security Technical Implementation Guide2025-05-16

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-09.2Asymmetric Keys
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
IA-5(1)Password-based Authentication
1.00
IA-7Cryptographic Module Authentication
1.00
PE-3Physical Access Control
1.00
SA-9(5)Processing, Storage, and Service Location
1.00
SC-12(3)Asymmetric Keys
1.00
SC-13Cryptographic Protection
1.00
SC-15(3)Disabling and Removal in Secure Work Areas
1.00
SC-15(4)Explicitly Indicate Current Participants
1.00

+2 more (top 10 by confidence shown)

CCI1 mapping
CCI-002448
1.00

Details

Check Text (C-245542r961632_chk)

Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Control Plane. Run the command: grep -i basic-auth-file * If "basic-auth-file" is set in the Kubernetes API server manifest file this is a finding.

Fix Text (F-48772r863944_fix)

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Remove the setting "--basic-auth-file".