← Back to Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

V-285681

CAT II (Medium)

The operating system must protect security-relevant configuration files from unauthorized access and modification.

Rule ID

SV-285681r1272155_rule

STIG

Rancher Government Solutions (RGS) Harvester Government GPOS Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Security-relevant configuration files directly influence system behavior and security controls. Unauthorized access or modification to these files may permit attackers to alter security settings, expose credentials, bypass protections, or compromise system integrity. Restricting access and enforcing controlled ownership preserves the confidentiality and integrity of trusted system configuration data.

Check Content

Verify the operating system protects platform manifest configuration files and enforces defined token configuration settings.

1. As a privileged user, run the following command:

stat -c "%n %a %U %G" /var/lib/rancher/rke2/server/manifests/rke2-default-serviceaccount.yaml

2. Verify the output shows:

/var/lib/rancher/rke2/server/manifests/rke2-default-serviceaccount.yaml 600 root root

3. Verify the token behavior configuration:

sudo grep -i "automountServiceAccountToken" \
/var/lib/rancher/rke2/server/manifests/rke2-default-serviceaccount.yaml

If the manifest file is missing, ownership differs from root:root, permissions are more permissive than 600, or the token configuration differs from the approved baseline, this is a finding.

Fix Text

Ensure Harvester Government platform is running in its default configuration. 

1. Attempt to reboot the node to restore the original, immutable settings. Run the script again and check for failures.

2. If the check is still a finding, upgrade or reinstall Harvester Government platform in its default configuration.