TCP Timestamps Information Disclosure on EKS Nodes

One of our compliance we found the recommendation To disable TCP timestamps on linux add the line using 'net.ipv4.tcp_timestamps = 0' to /etc/sysctl.conf. Execute 'sysctl -p' to apply the settings at runtime this is inlined with -

The remote host implements TCP timestamps, as defined by RFC1323/RFC7323.

Please guide how to achieve this ?

主題

容器微型服務 AWS Well-Architected Framework 運算

標籤

Amazon Elastic Kubernetes Service 微型服務安全性 Linux

語言

English

Ganesh

已提問 5 個月前檢視次數 771 次

1 個回答

最新
最多得票
最多評論

這些答案是否有幫助？支持正確答案，以幫助社區從您的知識中受益。

Hi,

It depends on how you configure your EKS Nodes. It could be managed node groups, self-managed node groups or even EC2 instances added by the Karpenter to your cluster.

Anyway, you can create your own AMI images with the above changes, check if Bottlerocket has this enforcement enabled and switch to it or do the update via the UserData.

專家

Dmytro Sirant

已回答 5 個月前

Ganesh
5 個月前
ok, But is there any consequences if we setup 'net.ipv4.tcp_timestamps = 0' in our EKS nodes ? any performance issue we might face ? we want to fix this, without breaking our Cluster performance
==> The remote host implements TCP timestamps, as defined by RFC1323/RFC7323.
Dmytro Sirant 專家
5 個月前
Based on the information available about this feature, it can impact network performance and stability on the high load. Only you can test how it will impact your specific workload. I would assess the risks you have when it's enabled (I guess it's fingerprinting by the timestamp) and if it impacts your security at all.

TCP Timestamps Information Disclosure on EKS Nodes

相關內容