kubernetes的etcd、kubelet和kube-api CVE-2016-2183 漏洞解决

wisheen

已于 2022-08-17 09:29:20 修改

阅读量3.1k

点赞数 1

分类专栏： Cloud 文章标签： etcd kubelet kubernetes

于 2022-08-15 19:23:36 首次发布

本文链接：https://blog.csdn.net/wisheen/article/details/126353033

版权

Cloud 专栏收录该内容

1 篇文章 1 订阅

订阅专栏

问题: CVE-2016-2183 漏洞，包括etcd、kubelet和kube-api。

问题测试:

root@master1:/var/lib/kubelet# nmap --script ssl-enum-ciphers -p 6443 127.0.0.1

Starting Nmap 7.60 ( https://nmap.org ) at 2022-08-15 11:08 UTC

Nmap scan report for localhost (127.0.0.1)

Host is up (0.000067s latency).

PORT STATE SERVICE

6443/tcp open sun-sr-https

| ssl-enum-ciphers:

| TLSv1.2:

| ciphers:

| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C

| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A

| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A

| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A

| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A

| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (rsa 2048) - A

| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C

| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A

| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A

| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A

| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A

| compressors:

| NULL

| cipher preference: client

| warnings:

| 64-bit block cipher 3DES vulnerable to SWEET32 attack

|_ least strength: C

上面会有64-bit block cipher 3DES vulnerable to SWEET32 attack提示

解决方案: 去除3DES的加密

具体步骤: 以sealos部署kube1.19为例，其他请自行查阅配置

# 去除3DES，其他保留和之前一致

# kubelet 在config.yaml增加tlsCipherSuites属性

vi /var/lib/kubelet/config.yaml

tlsCipherSuites: ['TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256','TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305','TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256','TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384','TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305','TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256','TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA','TLS_RSA_WITH_AES_128_CBC_SHA','TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA','TLS_RSA_WITH_AES_128_GCM_SHA256','TLS_RSA_WITH_AES_256_CBC_SHA','TLS_RSA_WITH_AES_256_GCM_SHA384']

systemctl daemon-reload

systemctl restart kubelet.service

# kube-api 在kube-apiserver.yaml的command参数部分增加tls-cipher-suites

vi /etc/kubernetes/manifests/kube-apiserver.yaml

- --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384

# etcd 在etcd.yaml的command参数部分增加cipher-suites，注意没有tls前缀

# etcd有提示 unexpected TLS cipher suite "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"，去除对应加密模式

vi /etc/kubernetes/manifests/etcd.yaml

- --cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384

结果验证:

nmap --script ssl-enum-ciphers -p 10250 127.0.0.1

nmap --script ssl-enum-ciphers -p 6443 127.0.0.1

nmap --script ssl-enum-ciphers -p 2379 127.0.0.1

如上执行应该没有warnings

上面逻辑10250在所有节点执行（kubelet机器），6443和2379在所有master节点执行，修复完毕

参考文档:

https://www.cnblogs.com/pengpengboshi/p/16248565.html

https://docs.guance.com/scheck/4213-k8s-kubelet-tls-cipher-suites/

https://kubernetes.io/zh-cn/docs/reference/command-line-tools-reference/kubelet/