Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide

The Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide (V2 R2) has 101 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

101STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R2

CurrentPublished Wed Jul 24 2024 What changed in V2R2

Docker Enterprise Swarm manager auto-lock key must be rotated periodically.

Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide

Assessment Title

Rule Text

Docker Enterprise Swarm manager auto-lock key must be rotated periodically.

Description

Discussion Text

Rotate swarm manager auto-lock key periodically.

Swarm manager auto-lock key is not automatically rotated. Rotate them periodically as a best practice.

By default, keys are not rotated automatically.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-235849

Rule

SV-235849r961863_rule

Severity

medium

Rule Version

DKER-EE-005070

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Interview the system administrator to identify the key rotation process. Determine if there is a key rotation record and if the keys are rotated at a pre-defined frequency.

If the swarm manager auto-lock key is not rotated on a regular basis, this is a finding.

Implementation Procedure

Fix Text

Run the below command to rotate the keys.

docker swarm unlock-key --rotate

Additionally, to facilitate audit for this recommendation, maintain key rotation records and ensure that a pre-defined frequency for key rotation is established.

STIG check 75 of 101 in the Docker Enterprise 2.x Linux/UNIX STIG checklist

← Previous · V-235848Docker Swarm must have the minimum number of manager nodes.Next · V-235850 →Docker Enterprise node certificates must be rotated as defined in the System Security Plan (SSP).