Skip to main content

Basic Authentication Should Be Disabled

More Info:​

Ensure basic authentication is set to disabled on Kubernetes clusters.

Risk Level​

High

Address​

Reliability, Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Using Console

To remediate the "Basic Authentication Should Be Disabled" misconfiguration in GCP using the GCP console, you can follow these steps:

  1. Open the GCP console and select the project that you want to work on.

  2. Go to the Cloud Run service that you want to remediate.

  3. Click on the "Edit and deploy new revision" button.

  4. Scroll down to the "Container" section and click on the "Show advanced settings" link.

  5. In the "Container" section, locate the "Environment variables" field.

  6. Click on the "Add item" button to add a new environment variable.

  7. In the "Name" field, enter "DISABLE_BASIC_AUTH".

  8. In the "Value" field, enter "true".

  9. Click on the "Save" button to save the changes.

  10. Redeploy the service to apply the changes.

Once you have completed these steps, Basic Authentication will be disabled for the Cloud Run service in GCP.

Using CLI

To remediate the "Basic Authentication Should Be Disabled" misconfiguration for GCP using GCP CLI, follow these steps:

  1. Open the Cloud Shell in your GCP console.
  2. Run the following command to list all the Cloud SQL instances in your project:
gcloud sql instances list
  1. Choose the instance for which you want to disable basic authentication and run the following command to update the instance:
gcloud sql instances patch INSTANCE_NAME --database-flags=skip_enable_binlog_mysql=on

Replace INSTANCE_NAME with the name of your Cloud SQL instance.

  1. After running the above command, you will see the updated instance information. Verify that the skip_enable_binlog_mysql flag is set to ON.

  2. Run the following command to verify that basic authentication is disabled:

gcloud sql instances describe INSTANCE_NAME | grep requireSsl

If the output shows requireSsl: true, then basic authentication is disabled.

Note: Disabling basic authentication may affect your application's functionality, so make sure to test your application after making this change.

Using Python

To remediate the "Basic Authentication Should Be Disabled" misconfiguration in GCP using Python, you can follow these steps:

  1. Import the necessary libraries:
from googleapiclient import errors
from google.oauth2 import service_account
from google.cloud import asset_v1
  1. Set up the credentials to authenticate with the GCP API:
credentials = service_account.Credentials.from_service_account_file('path/to/credentials.json')
  1. Create a function to check if basic authentication is enabled:
def check_basic_auth(project_id):
    client = asset_v1.AssetServiceClient(credentials=credentials)
    asset_query = asset_v1.AssetQuery()
    asset_query.asset_types = ['google.compute.Instance']
    asset_query.query = f'project = "{project_id}" AND securityConfiguration.basicAuthEnabled = true'
    response = client.search_all_resources(scope=f'projects/{project_id}', query=asset_query)
    return response
  1. Create a function to disable basic authentication:
def disable_basic_auth(project_id, instance_name, zone):
    from googleapiclient.discovery import build
    compute = build('compute', 'v1', credentials=credentials)
    instance = compute.instances().get(project=project_id, zone=zone, instance=instance_name).execute()
    if 'securityConfiguration' not in instance:
        instance['securityConfiguration'] = {}
    instance['securityConfiguration']['basicAuthEnabled'] = False
    request = compute.instances().update(project=project_id, zone=zone, instance=instance_name, body=instance)
    response = request.execute()
    return response
  1. Call the check_basic_auth function to check if basic authentication is enabled:
response = check_basic_auth('your-project-id')
if response.total_size > 0:
    for result in response:
        instance_name = result.resource.name.split('/')[-1]
        zone = result.resource.location.split('/')[-1]
        disable_basic_auth('your-project-id', instance_name, zone)

This code will check if basic authentication is enabled for any instances in the specified project and disable it if it is enabled. You can run this code periodically to ensure that basic authentication remains disabled.

Using Terraform
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"         # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"       # e.g. "us-central1" or "us-central1-a"

  # ... other required arguments (networking, node_config, etc.) ...

  # Disable basic authentication and client certificate auth
  master_auth {
    username = ""                       # empty username disables basic auth
    password = ""                       # empty password disables basic auth

    client_certificate_config {
      issue_client_certificate = false  # do not issue client certs
    }
  }
}

Substitute:

  • GKE_CLUSTER with your Terraform resource name.
  • GKE_CLUSTER_NAME with the actual cluster name.
  • GCP_REGION_OR_ZONE with the region or zone of the cluster.

Changing master_auth on an existing google_container_cluster can force replacement of the control plane (and thus a full cluster recreate), which is an outage; plan this change accordingly.

Verification: terraform plan should show the master_auth block being added or updated so that username and password change to empty strings and client_certificate_config.issue_client_certificate changes to false, with no other unrelated changes.

Additional Reading:​