Kubernetes Security Technical Implementation Guide

The Kubernetes Security Technical Implementation Guide (V2 R6) has 92 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

92STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 01 2026

Kubernetes Worker Nodes must not have the sshd service enabled.

Kubernetes Security Technical Implementation Guide

Assessment Title

Rule Text

Kubernetes Worker Nodes must not have the sshd service enabled.

Description

Discussion Text

Worker Nodes are maintained and monitored by the Control Plane. Direct access and manipulation of the nodes must not take place by administrators. Worker nodes must be treated as immutable and updated via replacement rather than in-place upgrades.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-242394

Rule

SV-242394r1137639_rule

Severity

medium

Rule Version

CNTR-K8-000410

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Log in to each worker node. Verify that the sshd service is not enabled. To validate the service is not enabled, run the command:

systemctl is-enabled sshd.service

If the service sshd is enabled, this is a finding.

Note: If console access is not available, SSH access can be attempted. If the worker nodes cannot be reached, this requirement is "not a finding".

Implementation Procedure

Fix Text

To disable the sshd service, run the command:

chkconfig sshd off

Note: If access to the worker node is through an SSH session, it is important to realize there are two requirements for disabling and stopping the sshd service that must be done during the same SSH session. Disabling the service must be performed first and then the service stopped to guarantee both settings can be made if the session is interrupted.

STIG check 17 of 92 in the Kubernetes STIG checklist

← Previous · V-242393Kubernetes Worker Nodes must not have sshd service running.Next · V-242395 →Kubernetes dashboard must not be enabled.