Basic Authentication Should Be Disabled
More Info:
Ensure basic authentication is set to disabled on Kubernetes clusters.Risk Level
HighAddress
Security, ReliabilityCompliance Standards
CISGKETriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Basic Authentication Should Be Disabled” misconfiguration in GCP using the GCP console, you can follow these steps:
- Open the GCP console and select the project that you want to work on.
- Go to the Cloud Run service that you want to remediate.
- Click on the “Edit and deploy new revision” button.
- Scroll down to the “Container” section and click on the “Show advanced settings” link.
- In the “Container” section, locate the “Environment variables” field.
- Click on the “Add item” button to add a new environment variable.
- In the “Name” field, enter “DISABLE_BASIC_AUTH”.
- In the “Value” field, enter “true”.
- Click on the “Save” button to save the changes.
- Redeploy the service to apply the changes.
Using CLI
Using CLI
To remediate the “Basic Authentication Should Be Disabled” misconfiguration for GCP using GCP CLI, follow these steps:Replace If the output shows
- Open the Cloud Shell in your GCP console.
- Run the following command to list all the Cloud SQL instances in your project:
- Choose the instance for which you want to disable basic authentication and run the following command to update the instance:
INSTANCE_NAME with the name of your Cloud SQL instance.-
After running the above command, you will see the updated instance information. Verify that the
skip_enable_binlog_mysqlflag is set toON. - Run the following command to verify that basic authentication is disabled:
requireSsl: true, then basic authentication is disabled.Note: Disabling basic authentication may affect your application’s functionality, so make sure to test your application after making this change.Using Python
Using Python
To remediate the “Basic Authentication Should Be Disabled” misconfiguration in GCP using Python, you can follow these steps:This code will check if basic authentication is enabled for any instances in the specified project and disable it if it is enabled. You can run this code periodically to ensure that basic authentication remains disabled.
- Import the necessary libraries:
- Set up the credentials to authenticate with the GCP API:
- Create a function to check if basic authentication is enabled:
- Create a function to disable basic authentication:
- Call the check_basic_auth function to check if basic authentication is enabled: