Rancher Government Solutions RKE2 STIG

Rancher Government Solutions RKE2 Security Technical Implementation Guide

The Rancher Government Solutions RKE2 Security Technical Implementation Guide (V2 R7) has 21 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

21STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Wed Jul 01 2026

Configuration and authentication files for Rancher RKE2 must be protected.

Rancher Government Solutions RKE2 Security Technical Implementation Guide

Assessment Title

Rule Text

Configuration and authentication files for Rancher RKE2 must be protected.

Description

Discussion Text

There are various configuration files, logs, access credentials, and other files stored on the host filesystem that contain sensitive information.

These files could potentially be put at risk, along with other specific workloads and components:
- API server.
- proxy.
- scheduler.
- controller.
- etcd.
- Kubernetes administrator account information.
- audit log access, modification, and deletion.
- application access, modification, and deletion.
- container runtime files.

If an attacker can gain access to these files, changes can be made to open vulnerabilities and bypass user authorizations inherent within Kubernetes with RBAC implemented. It is crucial to ensure user permissions are enforced down through to the operating system. Protecting file permissions will ensure that if a nonprivileged user gains access to the system they will still not be able to access protected information from the cluster API, cluster configuration, and sensitive cluster information. This control relies on the underlying operating system also having been properly configured to allow only least privileged access to perform required operations.

Satisfies: SRG-APP-000133-CTR-000300, SRG-APP-000133-CTR-000295, SRG-APP-000133-CTR-000305, SRG-APP-000133-CTR-000310

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-254564

Rule

SV-254564r1156618_rule

Severity

medium

Rule Version

CNTR-R2-000520

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

File system permissions:
1. Verify correct permissions of the files in /etc/rancher/rke2.
cd /etc/rancher/rke2
ls -l

all owners are root:root
all permissions are 0600

2. Verify correct permissions of the files in /var/lib/rancher/rke2.
cd /var/lib/rancher/rke2
ls -l

all owners are root:root

3. Verify correct permissions of the files and directories in /var/lib/rancher/rke2/agent.
cd /var/lib/rancher/rke2/agent
ls -l

owners and group are root:root

File permissions set to at least 0640 for the following:
rke2controller.kubeconfig
kubelet.kubeconfig
kubeproxy.kubeconfig

Certificate file permissions set to 0600:
client-ca.crt
client-kubelet.crt
client-kube-proxy.crt
client-rke2-controller.crt
server-ca.crt
serving-kubelet.crt

Key file permissions set to 0600:
client-kubelet.key
serving-kubelet.key
client-rke2-controller.key
client-kube-proxy.key

The directory permissions to 0700:
pod-manifests
etc

4. Verify correct permissions of the files in /var/lib/rancher/rke2/bin.
cd /var/lib/rancher/rke2/bin
ls -l

all owners are root:root
all files are 0750

5. Verify correct permissions of the directory /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2
ls -l

owners are root:root
permissions are 0750

6. Verify correct permissions of each file in /var/lib/rancher/rke2/data.
cd /var/lib/rancher/rke2/data
ls -l

all owners are root:root
all files are 0750

7. Verify correct permissions of /var/lib/rancher/rke2/server.
cd /var/lib/rancher/rke2/server
ls -l

all owners are root:root

The following directories are set to 0700:
cred
db
tls

The following directories are set to 0750:
manifests
logs

The following file is set to 0600:
token

8. Verify the RKE2 Server configuration file on all RKE2 Server hosts contain the following:
(cat /etc/rancher/rke2/config.yaml)
write-kubeconfig-mode: "0600"

If any of the permissions specified above do not match the required level, this is a finding.

Implementation Procedure

Fix Text

File system permissions:
1. Fix permissions of the files in /etc/rancher/rke2:
cd /etc/rancher/rke2
chmod 0600 ./*
chown root:root ./*
ls -l

2. Fix permissions of the files in /var/lib/rancher/rke2:
cd /var/lib/rancher/rke2
chown root:root ./*
ls -l

3. Fix permissions of the files and directories in /var/lib/rancher/rke2/agent:
cd /var/lib/rancher/rke2/agent
chown root:root ./*
chmod 0700 pod-manifests
chmod 0700 etc
find . -maxdepth 1 -type f -name "*.kubeconfig" -exec chmod 0640 {} \;
find . -maxdepth 1 -type f -name "*.crt" -exec chmod 0600 {} \;
find . -maxdepth 1 -type f -name "*.key" -exec chmod 0600 {} \;
ls -l

4. Fix permissions of the files in /var/lib/rancher/rke2/bin:
cd /var/lib/rancher/rke2/bin
chown root:root ./*
chmod 0750 ./*
ls -l

5. Fix permissions directory of /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2
chown root:root data
chmod 0750 data
ls -l

6. Fix permissions of files in /var/lib/rancher/rke2/data:
cd /var/lib/rancher/rke2/data
chown root:root ./*
chmod 0750 ./*
ls -l

7. Fix permissions in /var/lib/rancher/rke2/server:
cd /var/lib/rancher/rke2/server
chown root:root ./*
chmod 0700 cred
chmod 0700 db
chmod 0700 tls
chmod 0750 manifests
chmod 0750 logs
chmod 0600 token
ls -l

Edit the RKE2 Server configuration file on all RKE2 Server hosts, located at /etc/rancher/rke2/config.yaml, to contain the following:

write-kubeconfig-mode: "0600"

Once the configuration file is updated, restart the RKE2 Server. Run the command:
systemctl restart rke2-server

STIG check 10 of 21 in the Rancher Government Solutions RKE2 STIG checklist

← Previous · V-254563All audit records must identify any containers associated with the event within Rancher RKE2.Next · V-254565 →Rancher RKE2 must be configured with only essential configurations.