TCP Timestamps Information Disclosure on EKS Nodes

One of our compliance we found the recommendation To disable TCP timestamps on linux add the line using 'net.ipv4.tcp_timestamps = 0' to /etc/sysctl.conf. Execute 'sysctl -p' to apply the settings at runtime this is inlined with -

The remote host implements TCP timestamps, as defined by RFC1323/RFC7323.

Please guide how to achieve this ?

주제

컨테이너 마이크로서비스 AWS Well-Architected 프레임워크 컴퓨팅

태그

아마존 Elastic Kubernetes 서비스 마이크로서비스 보안 리눅스

언어

English

Ganesh

질문됨 5달 전772회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

이 답변이 도움이 되었나요?커뮤니티가 여러분의 지식을 활용할 수 있도록 정답을 찬성하세요.

Hi,

It depends on how you configure your EKS Nodes. It could be managed node groups, self-managed node groups or even EC2 instances added by the Karpenter to your cluster.

Anyway, you can create your own AMI images with the above changes, check if Bottlerocket has this enforcement enabled and switch to it or do the update via the UserData.

전문가

Dmytro Sirant

답변함 5달 전

Ganesh
5달 전
ok, But is there any consequences if we setup 'net.ipv4.tcp_timestamps = 0' in our EKS nodes ? any performance issue we might face ? we want to fix this, without breaking our Cluster performance
==> The remote host implements TCP timestamps, as defined by RFC1323/RFC7323.
Dmytro Sirant 전문가
5달 전
Based on the information available about this feature, it can impact network performance and stability on the high load. Only you can test how it will impact your specific workload. I would assess the risks you have when it's enabled (I guess it's fingerprinting by the timestamp) and if it impacts your security at all.

TCP Timestamps Information Disclosure on EKS Nodes

관련 콘텐츠