STIGQter STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The audit information produced by Redis Enterprise DBMS must be protected from unauthorized deletion.

DISA Rule

SV-251204r960936_rule

Vulnerability Number

V-251204

Group Title

SRG-APP-000120-DB-000061

Rule Version

RD6X-00-006600

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To investigate the log files used by Redis Enterprise, perform the following steps:
1. SSH into the server running Redis Enterprise.
2. Issue the command chmod 640 /var/opt/redislabs/log/* to change permissions of log files that are not appropriately assigned permissions.
3. Issue the command chown owner:group -R /var/opt/redislabs/log/ if the ownership is not correct where the owner and group are substituted for the appropriate owner and group.

Redis Enterprise provides configurable role-based access control inherently within the product. To ensure that users are provided the appropriate permissions that they are authorized to use, check each user's assigned roles.
1. Log in to Redis Enterprise.
2. Navigate to the access controls tab.
3. Navigate to the users tab.
4. Ensure that each user is given a role appropriate for their authorization level.

Check Contents

To investigate the log files used by Redis Enterprise stored on the operating system, perform the following steps:
1. SSH into the server running Redis Enterprise.
2. Issue the command cd /var/opt/redislabs/log
3. Issue the command ls -ltr ./

Investigate the permissions on these files. These permissions should be 640 or 660 and assigned to the installation user and group or another appropriate group.

If the permissions are readable by other or assigned an inappropriate owner/group, this is a finding.

Redis Enterprise does not support the ability to perform transaction logging.

Redis Enterprise also provides configurable role-based access control inherently within the product. This is available to users with the cluster viewer. To verify that users are provided the appropriate permissions that they are authorized to use, check each user's assigned roles.
1. Log in to Redis Enterprise.
2. Navigate to the access controls tab.
3. Navigate to the users tab.
4. Review all roles assigned to a user and verify that user is given the appropriate role for their authorization level. Roles with the Cluster Management Role of admin, cluster_member, cluster_viewer, or db_member are able to view logs in the UI.

If the user is not given the appropriate role, this is a finding.

Vulnerability Number

V-251204

Documentable

False

Rule Version

RD6X-00-006600

Severity Override Guidance

To investigate the log files used by Redis Enterprise stored on the operating system, perform the following steps:
1. SSH into the server running Redis Enterprise.
2. Issue the command cd /var/opt/redislabs/log
3. Issue the command ls -ltr ./

Investigate the permissions on these files. These permissions should be 640 or 660 and assigned to the installation user and group or another appropriate group.

If the permissions are readable by other or assigned an inappropriate owner/group, this is a finding.

Redis Enterprise does not support the ability to perform transaction logging.

Redis Enterprise also provides configurable role-based access control inherently within the product. This is available to users with the cluster viewer. To verify that users are provided the appropriate permissions that they are authorized to use, check each user's assigned roles.
1. Log in to Redis Enterprise.
2. Navigate to the access controls tab.
3. Navigate to the users tab.
4. Review all roles assigned to a user and verify that user is given the appropriate role for their authorization level. Roles with the Cluster Management Role of admin, cluster_member, cluster_viewer, or db_member are able to view logs in the UI.

If the user is not given the appropriate role, this is a finding.

Check Content Reference

M

Target Key

5443