Check: DKER-EE-001770
Docker Enterprise 2.x Linux/UNIX STIG:
DKER-EE-001770
(in versions v2 r1 through v1 r1)
Title
Docker Incs official GPG key must be added to the host using the users operating systems respective package repository management tooling. (Cat III impact)
Discussion
All packaged components of Docker Enterprise are digitally signed using GPG keys maintained by Docker, Inc. The Docker Engine - Enterprise daemon, itself, is digitally signed. Furthermore, all Docker, Inc-managed Linux repositories are themselves signed using GPG keys. On Windows, if Docker is installed via the PowerShell PackageManagement (aka OneGet) provider, the provider is managed by Microsoft, and provider artifacts are signed by Microsoft. The Universal Control Plane (UCP) and Docker Trusted Registry (DTR) installation images are digitally signed by Docker, Inc using Docker Content Trust.
Check Content
For Linux systems, verify that the host is configured to trust Docker Inc's repository GPG keys and that Docker Engine - Enterprise is installed from these repositories as such. If installing in an offline environment, validate that the Engine's package signature matches that as published by Docker, Inc. Execute the following command to validate the Docker image signature digests of UCP and DTR: docker trust inspect docker/ucp:[ucp_version] docker/dtr:[dtr_version] Check that the "SignedTags" array for both images in the output includes a "Digest" field. If the SignedTags array does not contain a Digest field, this is a finding.
Fix Text
For Linux systems, add Docker Inc's official GPG key to the host using the operating system's respective package repository management tooling. If not using a package repository to install/update Docker Engine - Enterprise, verify that the Engine's package signature matches that as published by Docker, Inc. When retrieving the UCP and DTR installation images, use Docker, Inc's officially managed image repositories as follows: docker.io/docker/ucp:[ucp_version] docker.io/docker/dtr:[dtr_version] If downloading the UCP and DTR images for offline installation, use only Docker, Inc's officially managed package links as follows: https://docs.docker.com/ee/ucp/admin/install/install-offline/ https://docs.docker.com/ee/dtr/admin/install/install-offline/
Additional Identifiers
Rule ID: SV-235788r627491_rule
Vulnerability ID: V-235788
Group Title: SRG-APP-000131
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001749 |
The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. |
Controls
Number | Title |
---|---|
CM-5 (3) |
Signed Components |