CIS Kong Gateway Benchmark

This recommendation verifies that Kong is running the latest stable version on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Kong version
kong version
kong health

# Update Kong to latest stable
apt-get update && apt-get install --only-upgrade kong
# Or via Docker:
# docker pull kong:latest
kong migrations up
kong restart

This recommendation verifies that Kong runs as a dedicated non-root user on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Kong runs as dedicated user
ps -eo user,pid,comm | grep kong
grep -E 'nginx_user' /etc/kong/kong.conf

# Configure dedicated user
# In kong.conf:
# nginx_user = kong kong
useradd -r -s /usr/sbin/nologin kong
chown -R kong:kong /etc/kong/

This setting ensures that Admin API is restricted to localhost with TLS on the Kong Gateway API gateway. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Kong Gateway API gateway is essential for defense in depth.

# Check Admin API binding
grep 'admin_listen' /etc/kong/kong.conf
curl -s http://localhost:8001/status

# Restrict Admin API to localhost
# In kong.conf:
# admin_listen = 127.0.0.1:8001 ssl
# admin_ssl_cert = /etc/kong/ssl/admin-cert.pem
# admin_ssl_cert_key = /etc/kong/ssl/admin-key.pem
# Do NOT expose admin API on 0.0.0.0

This recommendation verifies that RBAC is enabled for Admin API access on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RBAC configuration
grep -E 'enforce_rbac|admin_gui_auth' /etc/kong/kong.conf
curl -s http://localhost:8001/rbac/users | head -20

# Enable RBAC for Admin API
# In kong.conf:
# enforce_rbac = on
# admin_gui_auth = basic-auth
# admin_gui_session_conf = {"secret":"s3cret","cookie_secure":true}
# Create admin users with specific roles via Admin API

This recommendation verifies that proxy listeners use TLS 1.2+ with strong ciphers on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check proxy TLS configuration
grep -E 'proxy_listen|ssl_cert|ssl_protocols' /etc/kong/kong.conf

# Configure proxy TLS
# In kong.conf:
# proxy_listen = 0.0.0.0:8443 ssl
# ssl_cert = /etc/kong/ssl/cert.pem
# ssl_cert_key = /etc/kong/ssl/key.pem
# ssl_protocols = TLSv1.2 TLSv1.3
# ssl_ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

This recommendation verifies that upstream connections use TLS with verification on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check upstream TLS
curl -s http://localhost:8001/upstreams | python3 -m json.tool | grep -E 'https|tls' | head -10

# Configure mutual TLS for upstreams
curl -s -X PATCH http://localhost:8001/upstreams/{upstream_id} \
  -d 'https_verify=true' \
  -d 'https_verify_depth=2' \
# In kong.conf:
# upstream_keepalive_pool_size = 60
# upstream_keepalive_max_requests = 100

This recommendation verifies that access logging plugin is enabled on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging plugins
curl -s http://localhost:8001/plugins | python3 -m json.tool | grep -E 'file-log|syslog|http-log'

# Enable access logging
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=file-log' \
  -d 'config.path=/var/log/kong/access.log' \
  -d 'config.reopen=true'
# Or use syslog plugin:
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=syslog' \
  -d 'config.facility=local0'

This recommendation verifies that error logging with rotation is configured on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check error log configuration
grep -E 'proxy_error_log|admin_error_log|log_level' /etc/kong/kong.conf

# Configure error logging
# In kong.conf:
# proxy_error_log = /var/log/kong/error.log
# admin_error_log = /var/log/kong/admin-error.log
# log_level = notice
# Configure log rotation:
cat > /etc/logrotate.d/kong << 'EOF'
/var/log/kong/*.log {
    daily
    rotate 30
    compress
    missingok
}
EOF

This recommendation verifies that rate limiting plugin is configured on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting plugin
curl -s http://localhost:8001/plugins | python3 -m json.tool | grep 'rate-limiting'

# Enable rate limiting
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=rate-limiting' \
  -d 'config.minute=100' \
  -d 'config.hour=1000' \
  -d 'config.policy=redis' \
  -d 'config.redis_host=redis.internal'

This recommendation verifies that authentication plugins are enabled on routes on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication plugins
curl -s http://localhost:8001/plugins | python3 -m json.tool | grep -E 'key-auth|jwt|oauth2|basic-auth'

# Enable authentication on routes
curl -s -X POST http://localhost:8001/routes/{route_id}/plugins \
  -d 'name=key-auth'
# Or JWT auth:
curl -s -X POST http://localhost:8001/routes/{route_id}/plugins \
  -d 'name=jwt'
# Create consumer credentials:
curl -s -X POST http://localhost:8001/consumers \
  -d 'username=app1'

This recommendation verifies that IP restriction and CORS plugins are configured on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CORS and IP restriction plugins
curl -s http://localhost:8001/plugins | python3 -m json.tool | grep -E 'cors|ip-restriction|bot-detection'

# Configure request security plugins
# IP restriction:
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=ip-restriction' \
  -d 'config.allow=10.0.0.0/8'
# CORS:
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=cors' \
  -d 'config.origins=https://app.example.com' \
  -d 'config.methods=GET,POST' \
  -d 'config.credentials=true'

This recommendation verifies that request size limiting and header sanitization are configured on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check request size and transformation
curl -s http://localhost:8001/plugins | python3 -m json.tool | grep -E 'request-size-limiting|request-transformer'

# Configure request security
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=request-size-limiting' \
  -d 'config.allowed_payload_size=10'
# Remove sensitive headers:
curl -s -X POST http://localhost:8001/plugins \
  -d 'name=request-transformer' \
  -d 'config.remove.headers=X-Internal-Token'

This recommendation verifies that database connections use TLS with certificate verification on the Kong Gateway API gateway. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kong Gateway API gateway vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database configuration
grep -E 'database|pg_host|pg_ssl' /etc/kong/kong.conf

# Harden database connection
# In kong.conf:
# database = postgres
# pg_host = db.internal
# pg_port = 5432
# pg_ssl = on
# pg_ssl_verify = on
# pg_ssl_cert = /etc/kong/ssl/pg-client.pem
# pg_ssl_cert_key = /etc/kong/ssl/pg-client-key.pem

This setting ensures that configuration file permissions are restricted on the Kong Gateway API gateway. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Kong Gateway API gateway is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /etc/kong/kong.conf
find /etc/kong -type f -exec stat -c '%a %n' {} \;

# Restrict configuration permissions
chmod 640 /etc/kong/kong.conf
chown root:kong /etc/kong/kong.conf
chmod 600 /etc/kong/ssl/*.pem
chmod 750 /etc/kong/