> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Kubeconfig File Permissions Set To 600 Or More Restrictive

### More Info:

If the kube-proxy kubeconfig file exists it may contain connection credentials and should be protected. Permissions of 600 or more restrictive keep it readable only by root.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On each worker node, check if the kube-proxy kubeconfig file exists and view its current permissions:
           ```sh theme={null}
           ls -l /etc/kubernetes/proxy.conf 2>/dev/null || echo "proxy.conf not present on this node"
           ```

        2. On each worker node where `/etc/kubernetes/proxy.conf` exists, set its permissions to `600`:
           ```sh theme={null}
           chmod 600 /etc/kubernetes/proxy.conf
           ```

        3. On each worker node, confirm the file is owned by `root` and in the `root` group (adjust if necessary):
           ```sh theme={null}
           chown root:root /etc/kubernetes/proxy.conf
           ```

        4. On each worker node, verify the final permissions match the benchmark requirement:
           ```sh theme={null}
           stat -c permissions=%a /etc/kubernetes/proxy.conf
           ```
           The output must show:
           ```text theme={null}
           permissions=600
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify file permissions on worker node files such as `/etc/kubernetes/proxy.conf`; this must be fixed directly on each worker node’s host filesystem. Use SSH and follow the steps in the **Manual Steps** section to set the correct permissions.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix: Ensure /etc/kubernetes/proxy.conf has permissions 600 or more restrictive
        # Scope: Run on every worker node (as root). Safe to re-run.

        set -euo pipefail

        PROXY_CONF="/etc/kubernetes/proxy.conf"

        echo "==> Checking for ${PROXY_CONF}"

        if [ ! -e "${PROXY_CONF}" ]; then
          echo "File ${PROXY_CONF} does not exist on this node. Nothing to do."
          exit 0
        fi

        # Show current permissions
        current_perm="$(stat -c '%a' "${PROXY_CONF}")"
        echo "Current permissions: ${current_perm}"

        # Apply restrictive permissions (idempotent)
        echo "Setting permissions to 600 on ${PROXY_CONF}"
        chmod 600 "${PROXY_CONF}"

        # Verify
        echo "Verifying final permissions..."
        final_perm="$(stat -c '%a' "${PROXY_CONF}")"
        echo "Final permissions: ${final_perm}"

        if [ "${final_perm}" -le 600 ]; then
          echo "SUCCESS: ${PROXY_CONF} permissions are ${final_perm}, which is 600 or more restrictive."
          # Re-run of the benchmark audit equivalent
          echo "Audit output:"
          /bin/sh -c "if test -e ${PROXY_CONF}; then stat -c permissions=%a ${PROXY_CONF}; fi"
          exit 0
        else
          echo "ERROR: ${PROXY_CONF} permissions are ${final_perm}, which is NOT 600 or more restrictive."
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>