How score count is calculated ?

[ndubbala]

Hi Team,

Could you help me with understanding score calculation.

i don't understand score vs checks

[NOTE] 1.1.1 - Ensure the container host has been Hardened
[PASS] 1.1.2 - Ensure Docker is up to date
[INFO] * Using 19.03.8 which is current
[INFO] * Check with your operating system vendor for support and security maintenance for Docker

[INFO] 1.2 - Linux Hosts Specific Configuration
[PASS] 1.2.1 - Ensure a separate partition for containers has been created
[INFO] 1.2.2 - Ensure only trusted users are allowed to control Docker daemon
[INFO] * docker:x:994:
[PASS] 1.2.3 - Ensure auditing is configured for the Docker daemon
[PASS] 1.2.4 - Ensure auditing is configured for Docker files and directories - /var/lib/docker
[PASS] 1.2.5 - Ensure auditing is configured for Docker files and directories - /etc/docker
[PASS] 1.2.6 - Ensure auditing is configured for Docker files and directories - docker.service
[PASS] 1.2.7 - Ensure auditing is configured for Docker files and directories - docker.socket
[PASS] 1.2.8 - Ensure auditing is configured for Docker files and directories - /etc/default/docker
[PASS] 1.2.9 - 1.14 Audit Docker files and directories - /etc/sysconfig/docker-network
[PASS] 1.2.10 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json
[PASS] 1.2.11 - Ensure auditing is configured for Docker files and directories - /usr/bin/containerd
[PASS] 1.2.12 - Ensure auditing is configured for Docker files and directories - /usr/sbin/runc
[PASS] 1.2.13 - 1.15 Audit Docker files and directories - /etc/sysconfig/docker-registry
[PASS] 1.2.14 - 1.16 Audit Docker files and directories - /etc/sysconfig/docker-storage

[INFO] Checks: 16
[INFO] Score: 10

[ndubbala]

I see total 19 currentscore +1 entries in my code but getting score 10 even all checks are passed

total checks are 15 .

currentScore=$((currentScore + 1))

[konstruktoid]

Hi @ndubbala, I'll update the script with which tests are scored and which is not as soon as possible.
But the short answer is that it varies, see below, 1.1.2 is an Not Scored test and 1.2.1 is.

  check_1_1_2="$id_1_1_2  - $desc_1_1_2"
    resulttestjson "INFO" "Using $docker_version"
    currentScore=$((currentScore + 0))
    resulttestjson "PASS" "Using $docker_version"
    currentScore=$((currentScore + 0))

  check_1_2_1="$id_1_2_1 - $desc_1_2_1"
    resulttestjson "PASS"
    currentScore=$((currentScore + 1))
    resulttestjson "WARN"
    currentScore=$((currentScore - 1))

[ndubbala]

Thank you for your quick response Thomas.

Could you please let me when you add those code changes for scored and not scored.

[ndubbala]

Need your help in understanding more about docker_daemon_configuration section.

[konstruktoid]

Hi again @ndubbala, is there anything specific you need help with?
And have you read the CIS Docker Benchmark available at https://www.cisecurity.org/benchmark/docker/? It explains alot.

[ndubbala]

Thanks for the information Thomas.

Please let me know when you enable score checks.

[ndubbala]

Do we have scripts to pass those CIS recommendations ?

[konstruktoid]

Not that I'm aware of.

[ndubbala]

Hi @ndubbala, I'll update the script with which tests are scored and which is not as soon as possible.
But the short answer is that it varies, see below, 1.1.2 is an Not Scored test and 1.2.1 is.

  check_1_1_2="$id_1_1_2  - $desc_1_1_2"
    resulttestjson "INFO" "Using $docker_version"
    currentScore=$((currentScore + 0))
    resulttestjson "PASS" "Using $docker_version"
    currentScore=$((currentScore + 0))

  check_1_2_1="$id_1_2_1 - $desc_1_2_1"
    resulttestjson "PASS"
    currentScore=$((currentScore + 1))
    resulttestjson "WARN"
    currentScore=$((currentScore - 1))

Hi Thomas,

By any chance do you got time to loook into score issue ?