vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Change log: IBM Cloud Kubernetes Service Benchmark 

In this change log, you can learn about the latest changes, improvements, and updates for the IBM Cloud Kubernetes Service profile. The change log lists changes that were made, ordered by the version number.

To work with this profile, you must connect an instance of [Workload Protection](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance=setup-workload-protection).



  Profile versioning 

When specifications or controls are edited, removed from, or added to a profile in a way that is not compatible with the current version, a new version is released. To take advantage of the changes in a new version, update your attachments to use the newest profile version.

This profile is consistently updated and is not an exhaustive list of all the controls that might be required for every organization. Be sure to validate the available controls to determine where you might need to supplement your workloads with other security measures.



  Active versions 

The following table shows the service behavior changes for each version date. Switching to a later version date activates all changes that are introduced in earlier versions.



Table. Active versions of the IBM Cloud Kubernetes Service Benchmark

 Version number   Release date 

 Version 1.0.0    2023-07-12   









  Version 1.0.0 

Now available
:   Released today, 12 July 2023, the IBM Cloud Kubernetes Service Benchmark is a collection of controls designed to validate the configuration of your Kubernetes Service clusters. This profile introduces the concept of wp-rule assessments. These are assessments that are defined by the Workload Protection service and imported into Security and Compliance Center.
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-55-121)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-56-121)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-121cis-benchmark-remediations-121)







 Version 1.20 

[1.20 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_120cs_versions_120)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_120release_timeline_120)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_120prep-up-120)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_120120_before)
* [Update after master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_120120_after)





[Kubernetes version 1.20 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_120changelog_120)



* [Overview](https://cloud.ibm.com/docs/containers?topic=containers-changelog_120changelog_overview_120)
* [Version 1.20 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_120120_changelog)
: Kubernetes version [1.19.3_1525](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191193_1525), [1.18.10_1531](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11810_1531), [1.17.13_1543](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11713_1543), and [1.16.15_1550](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1550).

Worker node versions
: Worker node fix pack update change log documentation is available.
: Kubernetes version [1.19.3_1525](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1191193_1525_worker), [1.18.10_1531](https://cloud.ibm.com/docs/containers?topic=containers-118_changelog11810_1531_worker), [1.17.13_1543](https://cloud.ibm.com/docs/containers?topic=containers-117_changelog11713_1543_worker), and [1.16.15_1550](https://cloud.ibm.com/docs/containers?topic=containers-116_changelog11615_1550_worker).





 22 October 2020 

API key
: Added more information about [how the IBM Cloud Kubernetes Service API key is used](https://cloud.ibm.com/docs/containers?topic=containers-access-credsapi_key_about).

Benchmark for Kubernetes 1.19
: Review the [1.5 CIS Kubernetes benchmark results](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119) for clusters that run Kubernetes version 1.19.
* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-51-124)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-52-124)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-53-124)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-54-124)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-55-124)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-56-124)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-124cis-benchmark-remediations-124)









 Add-on version history 

[Supported cluster add-on versions](https://cloud.ibm.com/docs/containers?topic=containers-supported-cluster-addon-versionssupported-cluster-addon-versions)

[Ingress ALB and Fluentd version change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogcluster-add-ons-changelog)



* [Kubernetes Ingress image change log](https://cloud.ibm.com/docs/containers?topic=containers-cluster-add-ons-changelogkube_ingress_changelog)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-55-122)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-56-122)
* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-122cis-benchmark-remediations-122)









 Version 1.21 

[1.21 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_121cs_versions_121)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_121release_timeline_121)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_121prep-up-121)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_121121_before)
* [Update after master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_121121_after)





[Kubernetes version 1.21 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_121changelog_121)



* [Overview](https://cloud.ibm.com/docs/containers?topic=containers-changelog_121changelog_overview_121)
* [Version 1.21 change log](https://cloud.ibm.com/docs/containers?topic=containers-changelog_121121_changelog)
4.2.12 Ensure that the RotateKubeletServerCertificate argument is set to true Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) IBM 
 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers Not Scored 1 Pass IBM 









 5 Kubernetes policies 

Review the Kubernetes Policies results of the version 1.5 CIS Kubernetes benchmark.



 5.1 RBAC and service accounts 



Section 5.1 RBAC and Service Accounts benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 5.1.1 Ensure that the cluster-admin role is only used where required Not Scored 1 Pass Shared 
 5.1.2 Minimize access to secrets Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.1.3 Minimize wildcard use in Roles and ClusterRoles Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.1.4 Minimize access to create pods Not Scored 1 Pass Shared 
 5.1.5 Ensure that default service accounts are not actively used. Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 
 5.1.6 Ensure that Service Account Tokens are only mounted where necessary Not Scored 1 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-remediations-126) Shared 







 5.2 Pod Security Policies 



Section 5.2 Pod Security Policies benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility
Kubernetes Both v1.15.11 v1.15.12 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.15.12). The master update resolves CVE-2020-8555 (see the [IBM security bulletin](https://www.ibm.com/support/pages/node/6220220)). 
 Kubernetes Metrics Server Master N/A N/A Increased the CPU per node for the metrics-server container to improve availability of the metrics server API service for large clusters. 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 169 203 Updated the version 2.0 network load balancers (NLB) to fix problems with long-lived network connections to endpoints that failed readiness probes. Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967). 
 Ubuntu 18.04 packages Worker 4.15.0-99-generic 4.15.0-101-generic Updated worker node images with kernel and package updates for [CVE-2019-20795](https://nvd.nist.gov/vuln/detail/CVE-2019-20795), [CVE-2020-11494](https://nvd.nist.gov/vuln/detail/CVE-2020-11494), [CVE-2020-12762](https://nvd.nist.gov/vuln/detail/CVE-2020-12762), [CVE-2020-3810](https://nvd.nist.gov/vuln/detail/CVE-2020-3810), [CVE-2020-8616](https://nvd.nist.gov/vuln/detail/CVE-2020-8616), and [CVE-2020-8617](https://nvd.nist.gov/vuln/detail/CVE-2020-8617).
Kubernetes Dashboard Metrics Scraper Master v1.0.2 v1.0.3 See the [Kubernetes Dashboard metrics scraper release notes](https://github.com/kubernetes-sigs/dashboard-metrics-scraper/releases/tag/v1.0.3). 
 OpenVPN server Master N/A N/A OpenVPN server is now restarted during [cluster master refresh](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_apiserver_refresh). 
 Operator Lifecycle Manager Master 0.13.0 0.14.1 See the [Operator Lifecycle Manager release notes](https://github.com/operator-framework/operator-lifecycle-manager/releases/tag/0.14.1). 
 Operator Lifecycle Manager Catalog Master v1.5.6 v1.5.9 See the [Operator Lifecycle Manager Catalog release notes](https://github.com/operator-framework/operator-registry/releases/tag/v1.5.9).
Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-119cis-benchmark-remediations-119) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.21 IBM Cloud Kubernetes Service enables profiling for cluster administrator troubleshooting purposes. 
 1.2.22 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.23 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 1.2.24 IBM Cloud Kubernetes Service can optionally [enable Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server).
What else can I do to increase the security and compliance of my cluster? 

See [Security for Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-security).







 Running the worker node CIS Kubernetes benchmark 

To review the results of the CIS Kubernetes benchmark for Section 4: Worker node security configuration, you can run the test yourself. Because you own the worker nodes and are partially [responsible](https://cloud.ibm.com/docs/openshift?topic=openshift-responsibilities_iks) for their compliance, you might make configuration changes that you want to validate on your own.

These steps apply to clusters that run Red Hat OpenShift version 4.5 or later only.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Create a project for the resources to run the benchmark.

oc create ns ibm-kube-bench-test
2. Create a ConfigMap with the config and node configuration files from the [kube-samples](https://github.com/IBM-Cloud/kube-samples/tree/master/cis-kube-benchmark/cis-1.5/ibm) GitHub repository.



1. Download the the config and node configuration files into a local directory called ibm. You can also clone the repository and navigate into the ibm directory.



* [config file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/config.yaml)
* [node file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/node.yaml)



2.
Scored 2 [Fail](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-125cis-benchmark-remediations-125) Shared 









 IBM remediations and explanations 

Review information from IBM on the CIS Benchmark results.



Explanation and remediation

 Section Remediation/Explanation 

 1.2.1 IBM Cloud Kubernetes Service utilizes RBAC for cluster protection, but allows anonymous discovery, which is considered reasonable per [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
 1.2.10 IBM Cloud Kubernetes Service does not enable the [EventRateLimit](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/eventratelimit) admission controller since it is a Kubernetes alpha feature. 
 1.2.12 IBM Cloud Kubernetes Service does not enable the [AlwaysPullImages](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/alwayspullimages) admission controller since it overrides a container's imagePullPolicy and may impact performance. 
 1.2.13 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/). 
 1.2.16 IBM Cloud Kubernetes Service can optionally configure [Pod security admission](https://cloud.ibm.com/docs/containers?topic=containers-pod-security-admission), which is similar to the unsupported [Kubernetes pod security policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/).
IBM Cloud File Storage for Classic plug-in and monitor Master 358 373 Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967) and [CVE-2020-11655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11655). 
 Kubernetes Both v1.17.5 v1.17.6 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.17.6). 
 Kubernetes Dashboard Master v2.0.0-rc7 v2.0.0 See the [Kubernetes Dashboard release notes](https://github.com/kubernetes/dashboard/releases/tag/v2.0.0). 
 Kubernetes Metrics Server Master N/A N/A Increased the CPU per node for the metrics-server container to improve availability of the metrics server API service for large clusters. 
 Kubernetes NodeLocal DNS cache Master 1.15.8 1.15.13 See the [Kubernetes NodeLocal DNS cache release notes](https://github.com/kubernetes/dns/releases/tag/1.15.13). Updated the node-local-dns daemon set to include the prometheus.io/port and prometheus.io/scrape annotations on the pods. 
 Load balancer and load balancer monitor for IBM Cloud Provider Master 177 208 Updated the version 2.0 network load balancers (NLB) to clean up unnecessary IPVS rules. Improved application logging. Updated image for [CVE-2020-1967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967).
(https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkbenchmark-meaning)
* [What parts of the benchmark am I responsible for?](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkbencmark-resp)
* [What if some part of the service fails to comply with a recommendation?](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkbencmark-service-compliance)
* [What else can I do to increase the security and compliance of my cluster?](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkbenchmark-what-else)



* [Running the worker node CIS Kubernetes benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmarkcis-worker-test)



[Comparing the CIS Kubernetes and the Compliance Operator benchmarks](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmark-comparisonbenchmark-comparison)



* [Major differences](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmark-comparisonbenchmark-comparison-major)
* [Minor differences](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmark-comparisonbenchmark-comparison-minor)





 Version 4.13 

[4.13 version information and update actions](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_413cs_versions_413)



* [Release timeline](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_versions_413release_timeline_413)
* [Change log for master fix pack 1.26.1_1519 and worker node fix pack 1.26.1_1520, released 1 February 2023](https://cloud.ibm.com/docs/containers?topic=containers-changelog_1261261_1519_and_1261_1520)





[Version 1.26 CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-126)



* [1 Master node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-1-126)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-11-126)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-12-126)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-13-126)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-14-126)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-2-126)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-section-3-126)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-126cis-benchmark-31-126)
* [5.1 RBAC and service accounts](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-51-120)
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-52-120)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-53-120)
* [5.4 Secrets management](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-54-120)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-55-120)
* [5.6 General policies](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-56-120)



* [IBM remediations and explanations](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-120cis-benchmark-remediations-120)







 Version 1.19 

[1.19 version information and update actions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_119cs_versions_119)



* [Release timeline](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_119release_timeline_119)
* [Preparing to update](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_119prep-up-119)



* [Update before master](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions_119119_before)
NodeLocal DNS caching (beta)
: For clusters that run Kubernetes 1.15 or later, you can set up improved cluster DNS performance with [NodeLocal DNS caching](https://cloud.ibm.com/docs/containers?topic=containers-cluster_dnsdns_cache).

New! Version 1.15
: You can create community Kubernetes clusters that run version 1.15. To update from a previous version, review the [1.15 changes](https://cloud.ibm.com/docs/containers?topic=containers-cs_versionsk8s_version_archive).

Deprecated: Version 1.12
: Kubernetes version 1.12 is deprecated. Review the [changes across versions](https://cloud.ibm.com/docs/containers?topic=containers-cs_versions), and update to a more recent version.

Version change logs
: Updated the change logs for [1.14.4_1527](https://cloud.ibm.com/docs/containers?topic=containers-114_changelog1144_1527_worker), [1.13.8_1530](https://cloud.ibm.com/docs/containers?topic=containers-113_changelog1138_1530_worker), and [1.12.10_1561](https://cloud.ibm.com/docs/containers?topic=containers-112_changelog11210_1561_worker) worker node patch updates.







 July 2019 



 30 July 2019 

CLI change log
: Updated the IBM Cloud Kubernetes Service CLI plug-in change log page for the [release of version 0.3.95](https://cloud.ibm.com/docs/containers?topic=containers-cs_cli_changelog).

Ingress ALB change log
Review the Worker Node Security Configuration results of the version 1.5 CIS Kubernetes benchmark.



 4.1 Worker node configuration files 



Section 4.1 Worker Node Configuration benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 4.1.2 Ensure that the kubelet service file ownership is set to root:root Scored 1 Pass IBM 
 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root Scored 1 Pass IBM 
 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root Scored 1 Pass IBM 
 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root Scored 1 Pass IBM 
 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive Scored 1 Pass IBM 
 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root Scored 1 Pass IBM 







 4.2 Kubelet 



Section 4.2 Kubelet benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 4.2.1 Ensure that the --anonymous-auth argument is set to false Scored 1 Pass IBM 
 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow Scored 1 Pass IBM 
 4.2.3 Ensure that the --client-ca-file argument is set as appropriate Scored 1 Pass IBM 
 4.2.4 Ensure that the --read-only-port argument is set to 0 Scored 1 Pass IBM 
 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 Scored 1 Pass IBM