V-260910

Discussion

To limit the attack surface of MKE, it is important that the nonessential services are not installed. Containers are designed to be lightweight and isolated, and introducing SSH can add attack vectors. Unauthorized access or exploitation of SSH vulnerabilities would compromise the security of the container and the host system. SSH is not necessary for process management within containers, as container orchestration platforms provide mechanisms for starting, stopping, and monitoring containerized processes. SSH access within containers may bypass auditing mechanisms, making it harder to track and audit user activities.

Check Content

This check must be executed on all nodes in a Docker Enterprise cluster.

Verify no running containers have a process for SSH server. Using CLI, execute the following:

for i in $(docker container ls --format "{{.ID}}"); do
  pid=$(docker inspect -f '{{.State.Pid}}' "$i")
  ps -h --ppid "$pid" -o cmd
done | grep sshd

If a container is output, it has a process for SSH server, this is a finding.