Security Hardening

This is an overarching guide to further harden the security posture of a Cray System Management (CSM) system.

If a subset of the steps in this procedure were completed as a consequence of an install, upgrade, or other guidance, then it is safe to skip that subset following a review.

Prerequisites

None.

Procedure

  1. Change passwords and credentials.

    Perform procedure(s) in Change Passwords and Credentials.

  2. Customize (“randomize”) iPXE binary name.

    Perform procedure(s) in Customize iPXE Binary Names.

  3. (Optional) Enable Spire and OPA xname validation.

    Perform procedure(s) in xname validation.

  4. (Optional) Enable Kubernetes API encryption.

    Perform procedure(s) in Kubernetes Encryption.

  5. (Optional) Change Keycloak OAuth token lifetime.

    Perform procedure(s) in Change Keycloak token lifetime.

  6. (Optional) Remove Kiali.

    Perform procedure(s) in Remove Kiali.

  7. (Optional) Kubernetes API audit log file parameter settings.

    If Kubernetes API Auditing is enabled, then it is recommended to set --audit-log-maxage to 30 or appropriate value

    and --audit-log-maxsize parameter to 100 or appropriate value.

    For more information on setting the audit parameters refer Audit parameter settings.