CKSKubernetes 1.35

Lessons

Minimising the host: services, packages, ports

updated 2026-10-22 by seed

The task shape

"Reduce the attack surface of worker1: no FTP server, no open port 21, and only
the services the node needs."

# what is enabled at boot
systemctl list-unit-files --state=enabled
systemctl list-units --type=service --state=running

# what is actually listening
ss -tulpn

# a service nobody asked for
sudo systemctl disable --now vsftpd
sudo systemctl mask vsftpd            # even a dependency cannot start it now
# remove the package, not just the service
sudo apt-get remove --purge vsftpd && sudo apt-get autoremove -y
# RHEL: sudo dnf remove vsftpd

mask beats disable: a disabled unit can still be pulled in as a dependency, a
masked one cannot.

Firewall the ports that must stay

The exam usually says "block port 21 but keep 22 open" — a ufw/iptables line,
not a policy change:

sudo ufw deny 21/tcp
sudo ufw allow 22/tcp
sudo ufw status verbose

# or, when ufw is not installed
sudo iptables -A INPUT -p tcp --dport 21 -j DROP
sudo iptables-save > /etc/iptables/rules.v4   # persist

Kernel parameters, and the trap

apiVersion: v1
kind: Pod
metadata: {name: tuned, namespace: prod}
spec:
  securityContext:
    sysctls:
    - {name: net.core.somaxconn, value: "1024"}
    - {name: net.ipv4.ip_unprivileged_port_start, value: "0"}

Two classes of sysctl:

  • namespaced (net.* per-namespace, kernel.shm_rmid_forced, …) — allowed in a Pod.
  • unsafe (kernel.msgmax, net.ipv4.route.*, …) — allowed only if the kubelet was started with allowed-unsafe-sysctls, otherwise the Pod is rejected with SysctlForbidden.

If a task asks for an unsafe sysctl, the answer is to add it to the kubelet
config on the node, restart the kubelet, then create the Pod:

# /var/lib/kubelet/config.yaml
allowedUnsafeSysctls: ["kernel.msg*"]

Node-level hardening beyond this

  • Remove the shell from service accounts (/sbin/nologin) — a compromised app should not get an interactive shell.
  • Keep /etc/kubernetes and /var/lib/kubelet mode 0700 root:root.
  • protectKernelDefaults: true in the kubelet config (CIS 4.2.x).
  • Disable unused kernel modules if the task names one.

Verify like a marker

systemctl is-enabled vsftpd      # masked / disabled
ss -tulpn | grep :21             # nothing
sudo ufw status | grep 21        # deny
kubectl get pod tuned -n prod    # Running, not SysctlForbidden