STIGQter STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must enforce access control lists, as defined by the data owner, over defined subjects and objects.

DISA Rule

SV-251187r961317_rule

Vulnerability Number

V-251187

Group Title

SRG-APP-000328-DB-000301

Rule Version

RD6X-00-000950

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To configure a Redis ACL rule that can be assigned to a user role:
1. Navigate to access control >> redis acls.
2. Edit an existing Redis ACL by hovering over a Redis ACL and clicking "Edit".
3. Create a new Redis ACL by clicking "Add".
4. Enter a descriptive name for the Redis ACL. This will be used to reference the ACL rule to the role.
5. Define the ACL rule.
6. Click "Save".

Assign ACLs to roles and roles to users as appropriate.

For more information:
https://docs.redislabs.com/latest/rs/security/passwords-users-roles/

Check Contents

Review the system documentation to determine what organizationally defined Access Control permissions should be in place. Compare these settings with the settings on the actual DB.

1. Log in to Redis Enterprise.
2. Navigate to the access controls tab >> redis acls
3. Review ACLs for appropriate rules. If ACL rules are not defined as appropriate in system documentation, this is a finding.
4. Review roles.
5. Verify that each role is assigned an appropriate ACL. If a role is not assigned an appropriate ACL, this is a finding.
6. Review users.
7. Verify that each user is assigned a role. If a user is not assigned an appropriate role, this is a finding.

If any user accounts implicitly gain “Full Access” through the user/role/ACL relationship and are not authorized, this is a finding.

Vulnerability Number

V-251187

Documentable

False

Rule Version

RD6X-00-000950

Severity Override Guidance

Review the system documentation to determine what organizationally defined Access Control permissions should be in place. Compare these settings with the settings on the actual DB.

1. Log in to Redis Enterprise.
2. Navigate to the access controls tab >> redis acls
3. Review ACLs for appropriate rules. If ACL rules are not defined as appropriate in system documentation, this is a finding.
4. Review roles.
5. Verify that each role is assigned an appropriate ACL. If a role is not assigned an appropriate ACL, this is a finding.
6. Review users.
7. Verify that each user is assigned a role. If a user is not assigned an appropriate role, this is a finding.

If any user accounts implicitly gain “Full Access” through the user/role/ACL relationship and are not authorized, this is a finding.

Check Content Reference

M

Target Key

5443