STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must protect its audit configuration from unauthorized modification.

DISA Rule

SV-251206r960942_rule

Vulnerability Number

V-251206

Group Title

SRG-APP-000122-DB-000203

Rule Version

RD6X-00-006800

Severity

CAT II

CCI(s)

• CCI-001494 - Protect audit tools from unauthorized modification.

Weight

10

Fix Recommendation

Apply or modify access controls and permissions (in the file system/operating system) to tools used to view or modify audit log data. Tools must be accessible by authorized personnel only.

/var/opt/redislabs/log/ (or whatever the organizationally defined location for Redis logs) should have an appropriate and documented admin user and group owner and the directory should not have permissions more than 700.

To update these permissions, run the following commands:
chown redislabs:redislabs /var/opt/redislabs/log
chmod 700 /var/opt/redislabs/log

Check Contents

For validating privilege on the OS, verify user ownership, group ownership, and permissions on the redis audit directory.

From Linux command line as root:
> ls - ald /var/opt/redislabs/log/ (or whatever the organizationally defined location for Redis logs)

If the User owner is not a defined admin, this is a finding.

If the Group owner is not a defined admin group, this is a finding.

If the directory is more permissive than 700, this is a finding.

For validating privileges on the control plane, verify Redis Admin users that are listed on the control plane against documented approved admin users. If any users have unauthorized admin privileges, this is a finding.

Vulnerability Number

V-251206

Documentable

False

Rule Version

RD6X-00-006800

Severity Override Guidance

For validating privilege on the OS, verify user ownership, group ownership, and permissions on the redis audit directory.

From Linux command line as root:
> ls - ald /var/opt/redislabs/log/ (or whatever the organizationally defined location for Redis logs)

If the User owner is not a defined admin, this is a finding.

If the Group owner is not a defined admin group, this is a finding.

If the directory is more permissive than 700, this is a finding.

For validating privileges on the control plane, verify Redis Admin users that are listed on the control plane against documented approved admin users. If any users have unauthorized admin privileges, this is a finding.

Check Content Reference

M

Target Key

5443