Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Satisfies: SRG-OS-000250-GPOS-00093, SRG-OS-000033-GPOS-00014, SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058, SRG-OS-000120-GPOS-00061, SRG-OS-000299-GPOS-00117, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000396-GPOS-00176, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000478-GPOS-00223
Verify the Harvester Government RKE2 server configuration enforces approved Transport Layer Security (TLS) settings and protects security-relevant configuration files from unauthorized modification. 1. Access Harvester Government using a privileged account and verify the RKE2 server configuration file exists and is protected: stat -c "%n %a %U %G" /etc/rancher/rke2/config.yaml.d/90-harvester-server.yaml 2. Verify the output returns: /etc/rancher/rke2/config.yaml.d/90-harvester-server.yaml 600 root root If the file does not exist, is not owned by root:root, or permissions are more permissive than 600, this is a finding. 3. Review the configured TLS settings: grep -E "(tls-min-version|TLS_ECDHE)" /etc/rancher/rke2/config.yaml.d/90-harvester-server.yaml 4. Verify the configuration includes: tls-min-version: VersionTLS12 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 5. Verify the minimum TLS version is configured as "VersionTLS12" or greater, only organization-approved cipher suites are configured, and weak or deprecated protocols and ciphers are not enabled. If "tls-min-version" is absent, configured to a value less than "VersionTLS12", or approved cipher suites are missing or modified from the approved baseline, this is a finding.
Ensure Harvester Government platform is running in its default configuration. 1. Attempt to reboot the node to restore the original, immutable settings. Run the script again and check for failures. 2. If any checks return a "FAIL" status, upgrade or reinstall Harvester Government platform in its default configuration.