STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

DISA Rule

SV-251183r960735_rule

Vulnerability Number

V-251183

Group Title

SRG-APP-000001-DB-000031

Rule Version

RD6X-00-000100

Severity

CAT III

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

To modify the number of maximum sessions, run the following command:

rladmin tune db <db_name> max_connections <number_of_connections>
e.g., - rladmin tune db inline-jp-staging max_connections 15000

Check Contents

Redis sets this limit by default at 10k clients per shard. It reserves 32 for descriptors for internal use. The organization can set a limit based on its needs during the configuration. When the set limit is reached, Redis will deny all new incoming connections and inform senders "max number of clients reached".

To check for maximum connections, run the following command:
rladmin info db db:<insert_db_id>

where db:1 would be:
rladmin info db db:1

Search in the output for max_connections. If the max connections are greater than the organizationally defined value, this is a finding.

Note: Redis Enterprise 6 does support multiple users; however, it does not support the ability to limit connections per user. If using Redis Cluster, the max number of connections remains 10k; however, each node will use two connections (incoming/outgoing).

Vulnerability Number

V-251183

Documentable

False

Rule Version

RD6X-00-000100

Severity Override Guidance

Redis sets this limit by default at 10k clients per shard. It reserves 32 for descriptors for internal use. The organization can set a limit based on its needs during the configuration. When the set limit is reached, Redis will deny all new incoming connections and inform senders "max number of clients reached".

To check for maximum connections, run the following command:
rladmin info db db:<insert_db_id>

where db:1 would be:
rladmin info db db:1

Search in the output for max_connections. If the max connections are greater than the organizationally defined value, this is a finding.

Note: Redis Enterprise 6 does support multiple users; however, it does not support the ability to limit connections per user. If using Redis Cluster, the max number of connections remains 10k; however, each node will use two connections (incoming/outgoing).

Check Content Reference

M

Target Key

5443