Skip to content
CKSSystem HardeningTwo nodesEasy

Node attack surface: rogue service and sudo rights

Scenario cks-sys-002 · about 7 minutes · 8 points · 4 grader checks

Find and disable a service listening on a worker node and remove a local user's sudo membership without breaking the node.

  • systemd
  • attack-surface
  • least-privilege
  • linux-users
  • node

What you will practise

  • Map a listening port to its process and systemd unit
  • Stop and disable (or mask) a systemd unit
  • Remove a user from a privileged group

Start this lab

With the CLI installed and signed in, this command provisions a two nodes cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sys-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Reduce the attack surface of worker node exam-w1: 1. A leftover debugging service listens on TCP port 2121 on all interfaces of exam-w1. Find the systemd unit that runs it, stop it and make sure it does not start again at boot. Do not uninstall python3. 2. The local Linux user "contractor" on exam-w1 is a member of the "sudo" group. Remove that group membership; keep the user account. Do not touch the kubelet or containerd.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
System Hardening
Difficulty
Easy
Cluster topology
Two nodes
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
8
Grader checks
4
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 4 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More System Hardening labs

CKSSystem HardeningMedium

AppArmor: load a profile and confine a Pod

Load an AppArmor profile on a worker node in enforce mode and run a Pod confined by it through the securityContext field.

Two nodes · ~8 min · 8 points

  • apparmor
  • kernel-hardening
  • securitycontext
  • node
  • system-hardening

goldenkube start cks-sys-001

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.