Cis Docker 7.8
DevOps & Securitycis-docker-7.8Cis Docker 7.8 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that CA certificates are rotated as appropriate
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.8.0/cis-docker-7.8/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-docker-7-8, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
7.8 Ensure that CA certificates are rotated as appropriate (Manual)
Profile Applicability
- Level 1 - Docker Swarm
Description
You should rotate root CA certificates as appropriate.
Rationale
Docker Swarm uses TLS for clustering operations between its nodes. Certificate rotation ensures that in an event such as a compromised node or key, it is difficult to impersonate a node. Node certificates depend upon root CA certificates. For operational security, it is important to rotate these frequently. Currently, root CA certificates are not rotated automatically and you should therefore establish a process for rotating them in line with your organizational security policy.
Impact
None
Audit Procedure
You should check the time stamp on the root CA certificate file. For example:
ls -l /var/lib/docker/swarm/certificates/swarm-root-ca.crt
The certificate should show a time stamp in line with the organizational rotation policy.
Remediation
You should run the command below to rotate a certificate.
docker swarm ca --rotate
Default Value
By default, root CA certificates are not rotated.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.2 Use Unique PasswordsUse unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. | ● | ● | ● |
| v7 | 4.4 Use Unique PasswordsWhere multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. | ● | ● |