FILE I/O: PAST, PRESENT AND FUTURE CPPCON OCTOBER 3RD 2023 GUY DAVIDSON @HATCAT01INTRODUCTIONS • Head of Engineering Practice at Creative Assembly • 1980 – Acorn Atom • ISO/IEC JTC1/SC22/WG21 • BSI

-f 1 | xargs stat -c %U:%G Audit Execution: ./1.1.12.sh etcd Expected result: 'etcd:etcd' is present 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored) /etc/kubernetes/ssl Audit: stat -c %U:%G /etc/kubernetes/ssl Expected result: 'root:root' is present 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive Execution: ./check_files_permissions.sh '/etc/kubernetes/ssl/*.pem' Expected result: 'true' is present 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Scored) Result: PASS

-f 1 | xargs stat -c %U:%G Audit Execution: ./1.1.12.sh etcd Expected result: 'etcd:etcd' is present 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored) /etc/kubernetes/ssl Audit: stat -c %U:%G /etc/kubernetes/ssl Expected result: 'root:root' is present 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive Execution: ./check_files_permissions.sh '/etc/kubernetes/ssl/*.pem' Expected result: 'true' is present 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Scored) Result: PASS

CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 10 Expected Result: 'etcd:etcd' is present Returned Value: etcd:etcd 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is Result: CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 24 '--basic-auth-file' is not present Returned Value: root 4643 4626 22 16:15 ? 00:00:46 kube- apiserver --etcd-ke /bin/ps -ef | grep kube-apiserver | grep -v grep Expected Result: '--token-auth-file' is not present Returned Value: root 4643 4626 22 16:15 ? 00:00:46 kube- apiserver --etcd-ke

percent-encoding non-ASCII bytes, is assumed to be UTF-8. The special _charset_ field is ignored if present. Falcon expects form-encoded request bodies to be encoded according to the standard W3C algorithm optional) – A dict-like object in which to place the value of the param, but only if the param is present. default (any, optional) – If the param is not found returns the given value instead of None Returns: through 0xFF may be used on platforms that use wide characters. Note The Content-Type header, if present, will be overridden. If you wish to return custom error messages, you can create your own HTTP error

percent-encoding non-ASCII bytes, is assumed to be UTF-8. The special _charset_ field is ignored if present. Falcon expects form-encoded request bodies to be encoded according to the standard W3C algorithm significant. strip_url_path_trailing_slash Set to False in order to retain a trailing slash, if present, at the end of the URL path (default True). When this option is enabled, the URL path is normalized store (dict) – A dict-like object in which to place the value of the param, but only if the param is present. • default (any) – If the param is not found returns the given value instead of None Returns The

percent-encoding non-ASCII bytes, is assumed to be UTF-8. The special _charset_ field is ignored if present. Falcon expects form-encoded request bodies to be encoded according to the standard W3C algorithm significant. strip_url_path_trailing_slash Set to False in order to retain a trailing slash, if present, at the end of the URL path (default True). When this option is enabled, the URL path is normalized store (dict) – A dict-like object in which to place the value of the param, but only if the param is present. default (any) – If the param is not found returns the given value instead of None Returns: The

percent-encoding non-ASCII bytes, is assumed to be UTF-8. The special _charset_ field is ignored if present. Falcon expects form-encoded request bodies to be encoded according to the standard W3C algorithm significant. strip_url_path_trailing_slash Set to False in order to retain a trailing slash, if present, at the end of the URL path (default True). When this option is enabled, the URL path is normalized store (dict) – A dict-like object in which to place the value of the param, but only if the param is present. default (any) – If the param is not found returns the given value instead of None Returns: The