{"stig":{"title":"Rancher Government Solutions (RGS) Harvester Government CTR Security Technical Implementation Guide","version":"1","release":"1"},"checks":[{"vulnId":"V-285757","ruleId":"SV-285757r1272383_rule","severity":"medium","ruleTitle":"Harvester Government platform must generate, protect, store, and centrally transmit audit records to an enterprise repository using cryptographic mechanisms.","description":"Harvester Government platform must send audit events to a central managed audit log repository to provide reporting, analysis, and alert notification. Incident response relies on successful timely, accurate system analysis in order for the organization to identify and respond to possible security events.\n\nProtecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nSatisfies: SRG-APP-000111-CTR-000220, SRG-APP-000181-CTR-000485, SRG-APP-000290-CTR-000670, SRG-APP-000357-CTR-000800, SRG-APP-000358-CTR-000805, SRG-APP-000381-CTR-000905, SRG-APP-000447-CTR-001100, SRG-APP-000745-CTR-000120","checkContent":"Verify logging capability is enabled and are forwarded to a centralized location by accessing the Rancher Multi-Cluster Manager (MCM) managing the Rancher Harvester cluster.\n\n1. Navigate to the hamburger menu >> Virtualization Management >> Select Harvester Cluster >> Advanced >> Addons.\n\n2. Verify the \"rancher-logging\" add-on is deployed successfully.\n\nIf the \"rancher-logging\" add-on is disabled or not in a healthy state, this is a finding.\n\n3. Verify ClusterFlow is configured to process audit logs. Navigate to Cluster >> Monitoring & Logging >> Logging >> ClusterFlow.\n\nIf no ClusterFlow exists that processes audit logs and forwards them via outputRefs, this is a finding.\n\n4. Verify ClusterOutput is configured for centralized log forwarding. Navigate to Cluster >> Monitoring & Logging >> Logging >> ClusterOutput.\n\nIf ClusterOutputs are not configured to send logs to an external centralized system, this is a finding.\n \nIf secure transport (e.g., TLS) is not configured for the logs, this is a finding.\n\n5. Verify corresponding log records are present in the centralized logging system.\n\nIf audit logs are not observed at the centralized destination, this is a finding.","fixText":"Configure Harvester Government for audit logging.\n\n1. Navigate to the hamburger menu >> Virtualization Management >> Select Harvester Instance >> Advanced >> Addons.\n\n2. From this screen, enable \"rancher-logging\".\na. Click \"rancher-logging\".\nb. Select the three-dot menu.\nc. Click \"Enable\".\n\n3. Configure a Cluster Output and a Cluster Flow of type \"Audit\".\n- Select Monitoring & Logging >> Logging >> Cluster Output.\n- Select Monitoring & Logging >> Logging >> Cluster Flow.\na. Click \"Create\".\nb. Fill out the form.\nc. Click \"Create\".","ccis":["CCI-000154","CCI-001876","CCI-001496","CCI-001849","CCI-001851","CCI-003938","CCI-002754","CCI-003821"]},{"vulnId":"V-285758","ruleId":"SV-285758r1272711_rule","severity":"medium","ruleTitle":"Harvester Government platform must use internal system clocks to generate audit record time stamps.","description":"Understanding when the sequence of events for an incident occurred is crucial to understand what may have taken place. Without a common clock, the components generating audit events could be out of synchronization and would then present an incorrect account of the event. To give a clear picture, it is important that Harvester Government platform and its components use a common internal clock.\n\nSatisfies: SRG-APP-000116-CTR-000235, SRG-APP-000920-CTR-000320","checkContent":"Verify the Harvester Government cluster is configured to use approved and reachable Network Time Protocol (NTP) servers.\n\n1. Access the Harvester management console with appropriate administrative privileges by navigating to Advanced >> Settings.\n\n2. Locate the ntp-servers configuration parameter.\n\n3. Review the configured NTP server entries.\n\n4. Validate connectivity from a Harvester node using a command like \"cat /etc/systemd/timesyncd.conf\".\n\nIf one or more of the following conditions exist, this is a finding:\n- No NTP servers are configured.\n- Configured NTP servers are not organization approved.\n- Configured NTP servers are invalid, unreachable, or nonroutable from cluster nodes.\n- The system is not synchronizing time with the configured NTP sources.","fixText":"Configure the Harvester Government to use approved and reachable NTP servers.\n\n1. Access the Harvester management console with administrative privileges by navigating to Advanced >> Settings.\n\n2. Locate the ntp-servers parameter.\n\n3. Click the ellipses (...) on the right and select \"Edit Settings\".\n\n4. Configure the parameter with one or more organization-approved NTP servers (e.g., enterprise or authoritative time sources).\n\n5. Save the configuration changes.","ccis":["CCI-000159","CCI-004922"]},{"vulnId":"V-285759","ruleId":"SV-285759r1273643_rule","severity":"medium","ruleTitle":"Harvester Government platform runtime must enforce ports, protocols, and services that adhere to the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL).","description":"PPS within Harvester Government platform runtime must be controlled and conform to the PPSM CAL. Those ports, protocols, and services that fall outside the PPSM CAL must be blocked by the runtime. Instructions on the PPSM can be found in DOD Instruction 8551.01 Policy.\n\nSatisfies: SRG-APP-000142-CTR-000325, SRG-APP-000383-CTR-000910","checkContent":"Verify that all PPS configured and in use by the Harvester/RKE2 control plane and hosted workloads comply with the current PPSM CAL and are documented and approved.\n\n1. Review the control plane manifest configuration. Access the terminal on a control plane node with appropriate privileges and navigate to \"cd /var/lib/rancher/rke2/agent/pod-manifests\".\n\n2. Inspect the Kubernetes API server manifest for configured ports and services and execute:\n\ngrep -iE 'secure-port|insecure-port|etcd-servers' kube-apiserver.yaml\n\n3. Review runtime configuration of control plane components. Execute the following commands to identify runtime arguments and configured PPS. Review the output to identify all configured PPS endpoints.\n\n/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-apiserver -o=jsonpath=\"{.items[].spec.containers[].args}\"\n\n/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-controller-manager -o=jsonpath=\"{.items[].spec.containers[].args}\"\n\n/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-scheduler -o=jsonpath=\"{.items[].spec.containers[].args}\"\n\n4. Review additional system configuration. Execute the following to inspect supporting configuration sources for PPS usage:\n\ncat /var/lib/rancher/rke2/server/db/etcd/config\n\n5. Review user-deployed pods and services to identify exposed ports and protocols. This must be performed on a case-by-case basis based on deployed workloads.\n\n6. Validate against PPSM CAL and authorization. Compare all identified PPS (from manifests, runtime configuration, system configuration, and workloads) against the current PPSM CAL.\n\nIf any of the following are true, this is a finding: \n- Any PPS is not listed in the PPSM CAL and is not approved by the information system security officer (ISSO).\n- Any PPS is implemented but not documented in system authorization artifacts.\n- Any documented PPS does not align with the PPSM CAL or lacks ISSO approval.\n- Any PPS does not meet applicable Assurance Category requirements.","fixText":"Modify the PPS. \n\n1. Access the node terminal with appropriate privileges and open the RKE2 configuration file:\n\nvi /etc/rancher/rke2/config.yaml\n\n2. Modify the configuration to ensure:\n- Only approved PPS are defined.\n- Unauthorized or noncompliant PPS are removed or disabled.\n- Required PPS are explicitly configured in accordance with system documentation.\n\n3. Save the file.\n\n4. Apply the configuration changes by restarting the RKE2 service:\n\nsystemctl restart rke2-server","ccis":["CCI-000382","CCI-001762"]},{"vulnId":"V-285760","ruleId":"SV-285760r1272392_rule","severity":"medium","ruleTitle":"Harvester Government platform must terminate all network connections after 10 minutes of inactivity.","description":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, or de-allocating networking assignments at the application level if multiple application sessions are using a single, operating system level network connection. This does not mean that the application terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.\n\nSatisfies: SRG-APP-000190-CTR-000500, SRG-APP-000401-CTR-000965, SRG-APP-000880-CTR-000290","checkContent":"Verify time to live (TTL) (in minutes) on a user auth session.\n\n1. Access the Rancher MCM managing Harvester Government. Navigate to the hamburger menu >> Global Settings.\n\n2. Locate the \"auth-user-session-ttl-minutes\" setting.\n\nIf \"auth-user-session-ttl-minutes\" is not configured to \"10\" (or less) minutes, this is a finding.","fixText":"Configure the TTL (in minutes) on a user auth session.\n\n1. Access the Rancher MCM managing Harvester Government. Navigate to the hamburger menu >> Global Settings.\n\n2. Locate the \"auth-user-session-ttl-minutes\" setting.\n\n3. Select the ellipsis (…) to the right of the parameter and select \"Edit Config\".\n\n4. Edit the setting and configure it for 10 (or less) minutes.\n\n5. Click \"Save\".","ccis":["CCI-001133","CCI-004068","CCI-004192"]},{"vulnId":"V-285761","ruleId":"SV-285761r1272704_rule","severity":"medium","ruleTitle":"Harvester Government platform must enforce container resource limits.","description":"Harvester Government platform will offer services to users and these services share resources available on the hosting system. To share the resources in a manner that does not exhaust or over use resources, it is necessary for the container platform to have mechanisms that allow developers to size their containers to provide minimum and maximum amounts. If there is no mechanism to specify limits, container services can cause denial of service (DoS) by over usage.\n\nSatisfies: SRG-APP-000246-CTR-000605, SRG-APP-000247-CTR-000330","checkContent":"Verify the Harvester Government platform enforces container resource limits at the project or namespace level for all projects and namespaces within the cluster.\n\n1. Access the Rancher MCM managing Harvester Government. Navigate to the hamburger menu >> select the target cluster >> Cluster >> Projects/Namespaces.\n\n2. For each applicable project or namespace, select the ellipsis (…) to the right of the project or namespace name.\n\n3. Select \"Edit Config\".\n\n4. Open the \"Container Resource Limits\" configuration section.\n\nIf resource limits (CPU and memory) are not defined for the project or namespace, this is a finding. \n\nIf configured limits do not align with organizational requirements or are not appropriate for the deployed workloads, this is a finding.","fixText":"Configure the Harvester Government platform container resource limits.\n\n1. Access the Rancher MCM managing Harvester Government. Navigate to the hamburger menu >> select the target cluster >> Cluster >> Projects/Namespaces.\n\n2. For each applicable project or namespace, select the ellipsis (…) to the right of the project or namespace name.\n\n3. Select \"Edit Config\".\n\n4. Open the \"Container Resource Limits\" configuration section.\n\n5. Enter the appropriate resource limits and click \"Save\".","ccis":["CCI-001094","CCI-001095"]},{"vulnId":"V-285762","ruleId":"SV-285762r1272725_rule","severity":"medium","ruleTitle":"Harvester Government platform must configure alerts and notifications for system administrators (SAs) and the information system security officer (ISSO).","description":"Failure to configure alerts and notifications for SAs and the ISSO reduces the organization’s ability to detect, respond to, and mitigate security-relevant events in a timely manner. Without automated alerting, critical events may go unnoticed, increasing the risk of prolonged system exposure, operational degradation, or compromise.\n\nThe Rancher Harvester platform provides monitoring and alerting capabilities that notify designated personnel of defined conditions and security events. Proper configuration ensures that alerts are generated based on organization-defined thresholds and are delivered through approved communication channels.\n\nSatisfies: SRG-APP-000291-CTR-000675, SRG-APP-000292-CTR-000680, SRG-APP-000293-CTR-000685, SRG-APP-000294-CTR-000690, SRG-APP-000320-CTR-000750, SRG-APP-000359-CTR-000810, SRG-APP-000360-CTR-000815, SRG-APP-000474-CTR-001180, SRG-APP-000795-CTR-000130","checkContent":"Verify the Harvester Government platform is configured to forward audit and system logs to a centralized logging capability that supports alerting for security-relevant events.\n\nVerify Centralized Logging Capability:\n1. Access the Harvester or Rancher management interface or node configuration with appropriate privileges.\n\n2. Verify that a centralized logging solution (e.g., SIEM, log aggregation platform) is configured and actively receiving logs from:\n- Verified Harvester nodes.\n- RKE2 control plane components.\n- System and application workloads (as applicable).\n\nIf a centralized logging capability is not configured or not receiving logs, this is a finding. \n\nVerify Alerting Capability:\n1. Review the configuration of the centralized logging solution.\n\n2. Verify that alerting is configured to notify the SA and ISSO for:\n- Security-relevant events defined by the Authorizing Official (AO).\n- Audit processing failures (e.g., log forwarding failures, dropped logs, or pipeline errors).\n- Critical system or authentication events.\n\nIf alerting is not configured for AO-defined security events, this is a finding.\n\nIf alerting is not configured for audit/log processing failures, this is a finding.\n\nValidate Alert Configuration:\n1. Confirm that:\n- Alert rules or correlation policies are defined for required events.\n- Notification mechanisms (e.g., email) are configured and alert recipients include designated SA and ISSO personnel.\n\nIf alerts are not configured to notify the SA and ISSO, this is a finding.","fixText":"Configure the Harvester Government platform and centralized logging solution to support alerting for audit events and log processing failures.\n\nConfigure Centralized Logging:\n1. Configure Harvester to forward logs to an approved centralized logging solution (e.g., SIEM or log aggregation platform).\n\n2. Ensure the following sources are included:\n- Control plane components (kube-apiserver, controller-manager, scheduler).\n- Node-level system logs.\n- Application and workload logs (as required).\n\nConfigure Alerting Rules:\n1. Within the centralized logging solution, configure alerting policies to generate alerts for:\n- Security-relevant events defined by the AO.\n- Authentication and authorization events.\n- System errors and failures.\n- Audit/log processing failures (e.g., ingestion failures, pipeline errors, dropped logs).\n\nConfigure Notification Mechanisms:\n1. Configure alert notifications to ensure delivery SAs and the ISSO.\n\n2. Ensure notification methods are appropriate (e.g., email).\n\nNote: Harvester environments commonly rely on external SIEM or log aggregation solutions; configuration may reside outside the platform.","ccis":["CCI-000015","CCI-001855","CCI-001858","CCI-002702","CCI-003831"]},{"vulnId":"V-285763","ruleId":"SV-285763r1272726_rule","severity":"high","ruleTitle":"Harvester Government platform must be managed by Rancher MCM.","description":"The Rancher Harvester Government platform must be centrally managed by Rancher MCM to ensure consistent application of configuration management, security policies, and operational controls across the environment.\n\nFailure to manage Harvester through Rancher MCM results in decentralized administration, increasing the risk of configuration drift, inconsistent security settings, and unauthorized or untracked changes to system components. Without centralized management, there is limited visibility into system state, reduced ability to enforce standardized baselines, and diminished auditability of administrative actions.\n\nRancher MCM provides a unified control plane for managing Harvester clusters, enabling centralized enforcement of security configurations, role-based access control (RBAC), monitoring, logging, and lifecycle management. This ensures that all system changes are governed, traceable, and aligned with organizational policies and approved baselines.\n\nIn the absence of centralized management, the platform may operate outside of approved configuration management processes, increasing the likelihood of misconfigurations, delayed remediation of vulnerabilities, and reduced ability to maintain compliance with organizational and regulatory requirements.\n\nSatisfies: SRG-APP-000378-CTR-000885, SRG-APP-000023-CTR-000055, SRG-APP-000024-CTR-000060, SRG-APP-000025-CTR-000065, SRG-APP-000033-CTR-000090, SRG-APP-000033-CTR-000095, SRG-APP-000033-CTR-000100, SRG-APP-000038-CTR-000105, SRG-APP-000039-CTR-000110, SRG-APP-000065-CTR-000115, SRG-APP-000090-CTR-000155, SRG-APP-000118-CTR-000240, SRG-APP-000119-CTR-000245, SRG-APP-000120-CTR-000250, SRG-APP-000121-CTR-000255, SRG-APP-000122-CTR-000260, SRG-APP-000123-CTR-000265, SRG-APP-000133-CTR-000290, SRG-APP-000133-CTR-000295, SRG-APP-000133-CTR-000300, SRG-APP-000133-CTR-000305, SRG-APP-000133-CTR-000310, SRG-APP-000148-CTR-000335, SRG-APP-000148-CTR-000340, SRG-APP-000148-CTR-000345, SRG-APP-000148-CTR-000350, SRG-APP-000149-CTR-000355, SRG-APP-000150-CTR-000360, SRG-APP-000151-CTR-000365, SRG-APP-000152-CTR-000370, SRG-APP-000153-CTR-000375, SRG-APP-000163-CTR-000395, SRG-APP-000164-CTR-000400, SRG-APP-000166-CTR-000410, SRG-APP-000167-CTR-000415, SRG-APP-000168-CTR-000420, SRG-APP-000169-CTR-000425, SRG-APP-000170-CTR-000430, SRG-APP-000173-CTR-000445, SRG-APP-000174-CTR-000450, SRG-APP-000177-CTR-000465, SRG-APP-000185-CTR-000490, SRG-APP-000211-CTR-000530, SRG-APP-000233-CTR-000585, SRG-APP-000243-CTR-000600, SRG-APP-000317-CTR-000735, SRG-APP-000318-CTR-000740, SRG-APP-000340-CTR-000770, SRG-APP-000345-CTR-000785, SRG-APP-000378-CTR-000880, SRG-APP-000378-CTR-000890, SRG-APP-000380-CTR-000900, SRG-APP-000389-CTR-000925, SRG-APP-000391-CTR-000935, SRG-APP-000400-CTR-000960, SRG-APP-000402-CTR-000970, SRG-APP-000516-CTR-000790, SRG-APP-000705-CTR-000110, SRG-APP-000820-CTR-000170, SRG-APP-000825-CTR-000180, SRG-APP-000830-CTR-000190, SRG-APP-000835-CTR-000200, SRG-APP-000840-CTR-000210, SRG-APP-000845-CTR-000220, SRG-APP-000855-CTR-000240, SRG-APP-000860-CTR-000250, SRG-APP-000865-CTR-000260, SRG-APP-000910-CTR-000300","checkContent":"Verify Harvester Government is managed by Rancher MCM.\n\n1. Access the Harvester Management UI using system administrator credentials. Navigate to Settings >> Advanced.\n\nVerify the cluster-registration-url is configured and points to a legitimate Rancher MCM instance.\n\nIf Harvester is not registered to or managed by a Rancher MCM instance, this is a finding.\n\nIf administrative access to Harvester is performed outside of Rancher MCM, this is a finding.\n\n2. Verify Rancher MCM Authentication Configuration.\n\nAccess the Rancher Multi-Cluster Manager (MCM) UI and navigate to the hamburger menu >> Users & Authentication >> Auth Provider.\n\nIf no authentication provider is configured in Rancher MCM; OR\n\nThe configured authentication provider does not enforce multi-factor authentication (MFA); OR\n\nThe authentication mechanism does not meet DoW-approved authentication requirements (e.g., PKI-based or equivalent strong authentication), this is a finding.","fixText":"Register Harvester Government to Rancher MCM:\n\n1. Log in to Rancher MCM as an admin user.\n\n2. On the left menu, navigate to \"Virtualization Management\" and click \"Import Existing\" in the upper-left corner.\n\n3. Enter a name for the Harvester cluster and click \"Create\".\n\n4. Follow instructions in the dialogue to copy the registration URL to the Harvester cluster.\n\n5. Ensure Rancher MCM is using an authentication provider that meets organizational requirements and is using an authentication provider that leverages multifactor authentication.","ccis":["CCI-003980","CCI-000015","CCI-000016","CCI-000017","CCI-000213","CCI-001368","CCI-001414","CCI-000044","CCI-000171","CCI-000162","CCI-000163","CCI-000164","CCI-001493","CCI-001494","CCI-001495","CCI-001499","CCI-000764","CCI-000765","CCI-000766","CCI-004045","CCI-003627","CCI-004066","CCI-000187","CCI-000877","CCI-001082","CCI-001084","CCI-001090","CCI-002145","CCI-002235","CCI-002238","CCI-001813","CCI-002038","CCI-001953","CCI-002007","CCI-002009","CCI-000366","CCI-003628","CCI-004046","CCI-004047","CCI-004058","CCI-004059","CCI-004060","CCI-004061","CCI-004063","CCI-004064","CCI-004065","CCI-004909"]},{"vulnId":"V-285764","ruleId":"SV-285764r1272404_rule","severity":"high","ruleTitle":"Harvester Government platform must be running the latest release.","description":"Unsupported software and systems must not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilities.\n\nSoftware and systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation.\n\nWhen maintenance updates and patches are no longer available, software is no longer considered supported and should be upgraded or decommissioned.\n\nSatisfies: SRG-APP-001035-CTR-000323, SRG-APP-000456-CTR-001125, SRG-APP-000456-CTR-001130","checkContent":"Ensure Harvester Government is running latest release. \n\n1. Navigate to the Harvester Government UI and confirm the version in the bottom left corner.\n\n2. Release life cycle can be confirmed at:\nhttps://www.suse.com/lifecycle/#suse-virtualization\n\nIf Harvester Government is not running a supported version, this is a finding.","fixText":"Upgrade Harvester Government to the latest supported version.\n\nThe latest supported version can be found at the life cycle page: \nhttps://www.suse.com/lifecycle/#suse-virtualization","ccis":["CCI-003376","CCI-002605"]}]}