CIS etcd Benchmark

This recommendation verifies that etcd runs as a dedicated non-root user on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify etcd runs as a dedicated non-root user
ps -eo user,pid,comm | grep etcd
id etcd 2>/dev/null

# Create dedicated etcd user and update service
useradd -r -s /usr/sbin/nologin etcd
chown -R etcd:etcd /var/lib/etcd /etc/etcd
# Update systemd: User=etcd, Group=etcd

This setting ensures that data directory permissions are restricted on the etcd distributed key-value store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the etcd distributed key-value store is essential for defense in depth.

# Check etcd data directory permissions
stat -c '%a %U %G' /var/lib/etcd
ls -la /var/lib/etcd/

# Restrict data directory permissions
chmod 700 /var/lib/etcd
chown etcd:etcd /var/lib/etcd

This recommendation verifies that client-to-server TLS is enabled with client cert auth on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify client-to-server TLS is enabled
etcdctl endpoint status --endpoints=https://127.0.0.1:2379 --cacert=/etc/etcd/ca.pem --cert=/etc/etcd/server.pem --key=/etc/etcd/server-key.pem
grep -E 'cert-file|key-file|client-cert-auth' /etc/etcd/etcd.conf.yml

# Configure client TLS
# In etcd.conf.yml:
# client-transport-security:
#   cert-file: /etc/etcd/server.pem
#   key-file: /etc/etcd/server-key.pem
#   client-cert-auth: true
#   trusted-ca-file: /etc/etcd/ca.pem

This recommendation verifies that peer-to-peer TLS is enabled on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify peer-to-peer TLS is enabled
grep -E 'peer-cert-file|peer-key-file|peer-client-cert-auth' /etc/etcd/etcd.conf.yml

# Configure peer TLS
# In etcd.conf.yml:
# peer-transport-security:
#   cert-file: /etc/etcd/peer.pem
#   key-file: /etc/etcd/peer-key.pem
#   client-cert-auth: true
#   trusted-ca-file: /etc/etcd/ca.pem

This recommendation verifies that RBAC authentication is enabled on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if RBAC authentication is enabled
etcdctl auth status --endpoints=https://127.0.0.1:2379 --cacert=/etc/etcd/ca.pem
grep 'auth-token' /etc/etcd/etcd.conf.yml

# Enable RBAC authentication
etcdctl auth enable
# Create root role and user:
etcdctl role add root
etcdctl user add root --new-user-password='<secure>'
etcdctl user grant-role root root

This recommendation verifies that least-privilege roles are configured on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List roles and their permissions
etcdctl role list
etcdctl role get root
etcdctl user list

# Create least-privilege roles
etcdctl role add app-reader
etcdctl role grant-permission app-reader read /app/ --prefix
etcdctl user add app-svc --new-user-password='<secure>'
etcdctl user grant-role app-svc app-reader

This recommendation verifies that storage quota is configured on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify quota backend bytes is configured
grep 'quota-backend-bytes' /etc/etcd/etcd.conf.yml
etcdctl endpoint status -w table

# Set storage quota (e.g., 8 GB)
# In etcd.conf.yml:
# quota-backend-bytes: 8589934592
# Monitor with:
etcdctl alarm list

This recommendation verifies that automated snapshots are configured on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check snapshot and backup configuration
ls -la /var/backups/etcd/
crontab -l | grep etcd

# Configure automated snapshots
mkdir -p /var/backups/etcd
# Add cron job:
# 0 */6 * * * etcdctl snapshot save /var/backups/etcd/snap-$(date +\%Y\%m\%d-\%H\%M).db
# Verify snapshots:
etcdctl snapshot status /var/backups/etcd/latest.db -w table

This setting ensures that listen addresses are restricted to specific interfaces on the etcd distributed key-value store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the etcd distributed key-value store is essential for defense in depth.

# Verify listen addresses are restricted
grep -E 'listen-client-urls|listen-peer-urls|advertise-client-urls' /etc/etcd/etcd.conf.yml

# Bind to specific interfaces only
# In etcd.conf.yml:
# listen-client-urls: https://10.0.0.1:2379
# listen-peer-urls: https://10.0.0.1:2380
# Do NOT bind to 0.0.0.0

This setting ensures that maximum request size is limited on the etcd distributed key-value store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the etcd distributed key-value store is essential for defense in depth.

# Check maximum request size limits
grep 'max-request-bytes' /etc/etcd/etcd.conf.yml

# Set maximum request size
# In etcd.conf.yml:
# max-request-bytes: 1572864
# (default is 1.5 MB, reduce if not needed)

This recommendation verifies that automatic compaction is configured on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify WAL and compaction settings
grep -E 'auto-compaction|snapshot-count' /etc/etcd/etcd.conf.yml
etcdctl endpoint status -w table

# Configure automatic compaction
# In etcd.conf.yml:
# auto-compaction-mode: periodic
# auto-compaction-retention: '1h'
# snapshot-count: 10000

This recommendation verifies that cluster has minimum 3-node quorum on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster health and member list
etcdctl endpoint health --cluster
etcdctl member list -w table

# Verify minimum 3-node cluster for HA
etcdctl member list -w table
# Ensure odd number of members (3 or 5)
# Remove unhealthy members:
etcdctl member remove <member_id>

This recommendation verifies that etcd is running the latest stable version on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check etcd version
etcd --version
etcdctl version

# Update etcd to latest stable release
# Download from: https://github.com/etcd-io/etcd/releases
# Follow rolling upgrade procedure:
# 1. Backup current data
# 2. Stop member, replace binary, restart
# 3. Verify health before next member

This recommendation verifies that metrics endpoint is secured with TLS on the etcd distributed key-value store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the etcd distributed key-value store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify metrics endpoint is available and secured
curl -s --cacert /etc/etcd/ca.pem https://127.0.0.1:2379/metrics | head -5
grep 'metrics' /etc/etcd/etcd.conf.yml

# Configure metrics endpoint
# In etcd.conf.yml:
# listen-metrics-urls: https://127.0.0.1:2381
# Ensure metrics endpoint requires TLS