Etcd Data Directory Permissions Should Be 700 Or More

More Info:

Verifies that the etcd data directory has permissions of 700 or more restrictive. The etcd datastore holds all cluster state including secrets and must be tightly protected.

Risk Level

Medium

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every control plane node, identify the etcd data directory path:

   ps -ef | grep [e]tcd | grep -- --data-dir

   Note the value of the --data-dir argument (for example /var/lib/etcd or /var/lib/etcd/default.etcd). If no --data-dir is shown, use /var/lib/etcd/default.etcd.

2. On the same control plane node, confirm the directory exists (replace the path if different):

   ls -ld /var/lib/etcd

   or, if identified differently:

   ls -ld /var/lib/etcd/default.etcd

3. On the same control plane node, set the directory permissions to 700 (replace with the actual data directory if different):

   chmod 700 /var/lib/etcd

   or:

   chmod 700 /var/lib/etcd/default.etcd

4. On the same control plane node, ensure the directory is owned by the etcd user and group (adjust user/group if your deployment uses a different account):

   chown etcd:etcd /var/lib/etcd

   or:

   chown etcd:etcd /var/lib/etcd/default.etcd

5. Repeat steps 1–4 on every control plane node in the cluster.

6. Verification (on every control plane node): re-run the benchmark’s audit logic to confirm permissions are 700 or more restrictive:

   DATA_DIR=''
   for d in $(ps -ef | grep etcd | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
     if test -d "$d"; then DATA_DIR="$d"; fi
   done
   if ! test -d "$DATA_DIR"; then DATA_DIR=/var/lib/etcd/default.etcd; fi
   stat -c permissions=%a "$DATA_DIR"

   Ensure the output shows permissions=700 (or a more restrictive value such as 600).

Using kubectl

kubectl cannot change file system permissions on control plane nodes, including the etcd data directory at /var/lib/etcd. This finding must be remediated directly on every control plane node via host-level configuration; see the Manual Steps section for how to apply and verify the fix.

Automation

#!/usr/bin/env bash
#
# Remediation for:
# CISKubernetes 1.1.11 - Ensure that the etcd data directory permissions are set to 700 or more restrictive
#
# Usage: run as root on every control plane node
#   sudo bash fix-etcd-data-dir-perms.sh
#
set -euo pipefail

echo "[INFO] Detecting etcd data directory..."

DATA_DIR=""

# Find etcd --data-dir from running processes
while read -r line; do
  dir="$(printf '%s\n' "$line" | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')"
  if [ -n "$dir" ] && [ -d "$dir" ]; then
    DATA_DIR="$dir"
  fi
done < <(ps -ef | grep etcd | grep -- --data-dir || true)

# Fallback to default if not found
if [ -z "$DATA_DIR" ]; then
  DATA_DIR="/var/lib/etcd/default.etcd"
fi

if [ ! -d "$DATA_DIR" ]; then
  echo "[ERROR] etcd data directory not found: $DATA_DIR"
  echo "        Confirm the etcd --data-dir argument or create the directory if appropriate."
  exit 1
fi

echo "[INFO] etcd data directory detected: $DATA_DIR"

# Show existing permissions
CURRENT_PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "[INFO] Current permissions on $DATA_DIR: $CURRENT_PERMS"

# Apply restrictive permissions (700) idempotently
echo "[INFO] Setting permissions to 700 on $DATA_DIR (idempotent)..."
chmod 700 "$DATA_DIR"

# Verification
NEW_PERMS="$(stat -c '%a' "$DATA_DIR")"
echo "[INFO] New permissions on $DATA_DIR: $NEW_PERMS"

if [ "$NEW_PERMS" -le 700 ]; then
  echo "[SUCCESS] etcd data directory permissions are 700 or more restrictive."
  exit 0
else
  echo "[FAIL] etcd data directory permissions are NOT 700 or more restrictive."
  exit 2
fi