CIS Traefik Proxy Benchmark

This recommendation verifies that HTTPS entrypoints with HTTP-to-HTTPS redirect are configured on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check entrypoint TLS configuration:
grep -A10 'entryPoints' /etc/traefik/traefik.yml

# Verify HTTPS redirect:
curl -sI http://example.com | head -5

# Configure HTTPS entrypoints with HTTP redirect:
# traefik.yml:
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt
    http2:
      maxConcurrentStreams: 250

This recommendation verifies that TLS options enforce minimum TLS 1.2 with strong ciphers on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS options:
grep -A20 'tls' /etc/traefik/traefik.yml
grep -r 'tls' /etc/traefik/dynamic/ 2>/dev/null

# Configure strong TLS options:
# dynamic/tls.yml:
tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
      curvePreferences:
        - CurveP521
        - CurveP384
      sniStrict: true
    modern:
      minVersion: VersionTLS13

This recommendation verifies that the dashboard is secured with authentication and IP filtering on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check dashboard configuration:
grep -A10 'api' /etc/traefik/traefik.yml

# Test dashboard access:
curl -sI https://traefik.example.com/dashboard/

# Secure the dashboard with authentication:
# traefik.yml:
api:
  dashboard: true
  insecure: false  # NEVER set to true in production

# dynamic/dashboard.yml:
http:
  routers:
    dashboard:
      rule: "Host(`traefik.example.com`)"
      service: api@internal
      entryPoints:
        - websecure
      middlewares:
        - dashboard-auth
        - dashboard-ipwhitelist
      tls:
        certResolver: letsencrypt

  middlewares:
    dashboard-auth:
      basicAuth:
        users:
          - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
    dashboard-ipwhitelist:
      ipAllowList:
        sourceRange:
          - "10.0.0.0/8"
          - "172.16.0.0/12"

This recommendation verifies that access logs and application logs are enabled in JSON format on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check access logs:
grep -A10 'accessLog' /etc/traefik/traefik.yml

# Check general logging:
grep -A5 'log' /etc/traefik/traefik.yml

# Enable comprehensive logging:
# traefik.yml:
log:
  level: INFO
  filePath: "/var/log/traefik/traefik.log"
  format: json

accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  bufferingSize: 100
  filters:
    statusCodes:
      - "200-299"
      - "400-599"
    retryAttempts: true
    minDuration: "10ms"
  fields:
    headers:
      defaultMode: drop
      names:
        User-Agent: keep
        X-Forwarded-For: keep
        X-Real-Ip: keep

This recommendation verifies that rate limiting middleware is configured per source IP on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting middleware:
grep -r 'rateLimit' /etc/traefik/dynamic/ 2>/dev/null

# List active middlewares:
curl -s https://traefik.example.com/api/http/middlewares | python3 -m json.tool

# Configure rate limiting middleware:
# dynamic/middleware.yml:
http:
  middlewares:
    rate-limit:
      rateLimit:
        average: 100
        burst: 200
        period: 1s
        sourceCriterion:
          ipStrategy:
            depth: 1
            excludedIPs:
              - "127.0.0.1/32"
              - "10.0.0.0/8"

    global-rate-limit:
      rateLimit:
        average: 50
        burst: 100

# Apply to router:
http:
  routers:
    web-app:
      rule: "Host(`app.example.com`)"
      middlewares:
        - rate-limit

This recommendation verifies that security headers middleware is applied globally on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check security headers middleware:
grep -r 'headers' /etc/traefik/dynamic/ 2>/dev/null

# Test security headers:
curl -sI https://example.com | grep -iE 'strict|content-security|x-frame|x-content'

# Configure security headers middleware:
# dynamic/headers.yml:
http:
  middlewares:
    security-headers:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        frameDeny: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"
        referrerPolicy: "strict-origin-when-cross-origin"
        contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
        permissionsPolicy: "camera=(), microphone=(), geolocation=()"
        customResponseHeaders:
          X-Robots-Tag: "noindex, nofollow"
          server: ""

This recommendation verifies that Let's Encrypt uses DNS challenge with EC384 key type on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Let's Encrypt configuration:
grep -A15 'certificatesResolvers' /etc/traefik/traefik.yml

# Verify certificates:
ls -la /etc/traefik/acme/
openssl x509 -in /etc/traefik/certs/cert.pem -noout -dates 2>/dev/null

# Configure Let's Encrypt with DNS challenge:
# traefik.yml:
certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@example.com
      storage: /etc/traefik/acme/acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory
      keyType: EC384
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 30
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

# Secure acme.json permissions:
chmod 600 /etc/traefik/acme/acme.json
chown traefik:traefik /etc/traefik/acme/acme.json

This recommendation verifies that default certificate and secure file permissions are set on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check certificate stores:
grep -r 'certificates' /etc/traefik/dynamic/

# Verify certificate validity:
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates -issuer

# Configure certificate management:
# dynamic/certs.yml:
tls:
  certificates:
    - certFile: /etc/traefik/certs/wildcard.crt
      keyFile: /etc/traefik/certs/wildcard.key
      stores:
        - default

  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/default.crt
        keyFile: /etc/traefik/certs/default.key

# Set up certificate monitoring:
# Add to cron:
0 6 * * * /usr/local/bin/check-cert-expiry.sh /etc/traefik/certs/

This recommendation verifies that backend services have health checks configured on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check service health:
curl -s https://traefik.example.com/api/http/services | python3 -m json.tool | head -30

# Check health check config:
grep -r 'healthCheck' /etc/traefik/dynamic/

# Configure service health checks:
# dynamic/services.yml:
http:
  services:
    web-app:
      loadBalancer:
        servers:
          - url: "http://10.0.1.10:8080"
          - url: "http://10.0.1.11:8080"
          - url: "http://10.0.1.12:8080"
        healthCheck:
          path: /health
          interval: 10s
          timeout: 3s
          scheme: http
          headers:
            Host: app.example.com
        sticky:
          cookie:
            name: server_id
            secure: true
            httpOnly: true
            sameSite: strict

This recommendation verifies that circuit breaker and retry middleware are configured on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check circuit breaker:
grep -r 'circuitBreaker' /etc/traefik/dynamic/ 2>/dev/null

# Check retry middleware:
grep -r 'retry' /etc/traefik/dynamic/ 2>/dev/null

# Configure circuit breaker and retry:
# dynamic/resilience.yml:
http:
  middlewares:
    circuit-breaker:
      circuitBreaker:
        expression: "LatencyAtQuantileMS(50.0) > 1000 || NetworkErrorRatio() > 0.30 || ResponseCodeRatio(500, 600, 0, 600) > 0.25"
        checkPeriod: 10s
        fallbackDuration: 30s
        recoveryDuration: 60s

    retry-middleware:
      retry:
        attempts: 3
        initialInterval: 100ms

    buffering:
      buffering:
        maxRequestBodyBytes: 10485760
        maxResponseBodyBytes: 10485760

This recommendation verifies that Docker provider does not auto-expose containers on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check provider configuration:
grep -A20 'providers' /etc/traefik/traefik.yml

# For Docker provider:
ls -la /var/run/docker.sock

# Secure provider configuration:
# traefik.yml:
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false  # CRITICAL: don't auto-expose
    network: traefik-public
    constraints: "Label(`traefik.enable`, `true`)"
    watch: true

  file:
    directory: /etc/traefik/dynamic
    watch: true

# Run Traefik with read-only Docker socket:
# docker-compose.yml:
services:
  traefik:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    read_only: true
    security_opt:
      - no-new-privileges:true

This recommendation verifies that Traefik runs with least-privilege systemd hardening on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Traefik process user:
ps aux | grep traefik

# Check systemd service:
systemctl cat traefik 2>/dev/null | grep -iE 'user|group|protect|private'

# Harden Traefik systemd service:
cat > /etc/systemd/system/traefik.service << 'EOF'
[Unit]
Description=Traefik Proxy
After=network-online.target

[Service]
Type=notify
User=traefik
Group=traefik
ExecStart=/usr/local/bin/traefik --configFile=/etc/traefik/traefik.yml
Restart=always
RestartSec=5

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ReadWritePaths=/etc/traefik/acme /var/log/traefik
ReadOnlyPaths=/etc/traefik
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl restart traefik

This setting ensures that Prometheus metrics are enabled on a restricted entrypoint on the Traefik cloud-native reverse proxy. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Traefik cloud-native reverse proxy is essential for defense in depth.

# Check metrics configuration:
grep -A10 'metrics' /etc/traefik/traefik.yml

# Check Prometheus endpoint:
curl -s http://localhost:8082/metrics | head -20

# Configure Prometheus metrics:
# traefik.yml:
metrics:
  prometheus:
    entryPoint: metrics
    addEntryPointsLabels: true
    addRoutersLabels: true
    addServicesLabels: true
    buckets:
      - 0.1
      - 0.3
      - 1.2
      - 5.0

entryPoints:
  metrics:
    address: ":8082"

# Expose only on internal network:
# Use firewall to restrict metrics port
iptables -A INPUT -p tcp --dport 8082 ! -s 10.0.0.0/8 -j DROP

This recommendation verifies that distributed tracing is configured with OpenTelemetry on the Traefik cloud-native reverse proxy. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Traefik cloud-native reverse proxy vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check tracing configuration:
grep -A10 'tracing' /etc/traefik/traefik.yml

# Verify tracing endpoint:
curl -s http://localhost:16686/api/services 2>/dev/null | head

# Configure distributed tracing:
# traefik.yml:
tracing:
  otlp:
    http:
      endpoint: http://otel-collector.example.com:4318/v1/traces
      tls:
        insecureSkipVerify: false
    grpc:
      endpoint: otel-collector.example.com:4317
      tls:
        insecureSkipVerify: false

# Configure sampling for production:
experimental:
  otlp:
    sampleRate: 0.1  # 10% sampling