Docker Network Hardening

Harden Docker networking for Cortex XSOAR 6.13.

Docker creates a networking stack for container communication. By default, containers can communicate with all IP addresses. Use iptables rules to restrict this access.

These instructions apply to Docker-based Python and PowerShell integrations and automations. For JavaScript integrations, set js.http.restricted to a comma-separated list of allowed IPs or hosts.

The default Docker network is bridge and its default interface is docker0. List Docker networks with sudo docker network ls. Inspect a network with sudo docker network inspect <network name>.

Key	Value
js.http.restricted	169.254.169.254,localhost,127.0.0.1

Block network access to the host machine

Integrations and automations usually do not need host-network access. Block access from containers to host services, including Cortex XSOAR Server.

1. Add an iptables rule for each private host IP address:

   sudo iptables -I INPUT -s <IP address range> -d <host private ip address> -j DROP

   For Docker’s default 172.16.0.0/12 range, use:

   sudo iptables -I INPUT -s 172.16.0.0/12 -d 10.18.18.246 -j DROP

   If you configured another range in Docker’s daemon.json, use that range. You can also limit a specific source interface, such as docker0.
2. Block access to the Docker gateway IP:

   iptables -I INPUT -i docker0 -d 172.17.0.1/32 -j DROP

3. Optionally, list private host IP addresses:

   sudo ifconfig -a

Block cloud instance metadata access

Block containers from accessing the instance metadata service on 169.254.169.254.

sudo iptables -I DOCKER-USER -i docker0 -d 169.254.169.254/32 -j DROP

On GCP, allow DNS queries to the metadata server when required:

iptables -I DOCKER-USER -i docker0 -d 169.254.169.254/32 -p udp --dport 53 -j ACCEPT

For metadata service details, see the AWS documentation and GCP documentation.

Assign a Docker network for an image

Create a separate network for integrations that require metadata access. Most AWS integrations use the demisto/boto3py3 image.

1. Create the network:

   sudo docker network create -d bridge -o com.docker.network.bridge.name=docker-metadata aws-metadata

2. Add the following server configuration:

   Key	Value
   python.pass.extra.keys.demisto/boto3py3	--network=aws-metadata

3. Reset running containers with /reset_containers.
4. Verify the network:

   sudo docker network inspect aws-metadata

Block internal network access

Block selected integrations from internal resources. This is recommended for the Rasterize integration when processing untrusted URLs or HTML.

1. Create an external Docker network:

   sudo docker network create -d bridge -o com.docker.network.bridge.name=docker-external external

2. Block host access:

   iptables -I INPUT -i docker-external -d <host private ip> -j DROP

3. Block metadata access:

   sudo iptables -I DOCKER-USER -i docker-external -d 169.254.169.254/32 -j DROP

4. Block internal address ranges:

   sudo iptables -I DOCKER-USER -i docker-external -d 10.0.0.0/8 -j DROP
   sudo iptables -I DOCKER-USER -i docker-external -d 172.16.0.0/12 -j DROP
   sudo iptables -I DOCKER-USER -i docker-external -d 192.168.0.0/16 -j DROP

5. Add the following server configuration:

   Key	Value
   python.pass.extra.keys.demisto/chromium	--network=external

6. Reset running containers with /reset_containers.
7. Verify the network:

   sudo docker network inspect external

Persist iptables rules

iptables rules do not persist after a reboot. Save them using your operating system’s recommended configuration:

• Ubuntu
• Red Hat and related operating systems