STIGQter STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

If passwords are used for authentication, Redis Enterprise DBMS must store only hashed, salted representations of passwords.

DISA Rule

SV-251223r1018619_rule

Vulnerability Number

V-251223

Group Title

SRG-APP-000171-DB-000074

Rule Version

RD6X-00-008800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Develop, document, and maintain a list of DBMS database objects, database configuration files, associated scripts, applications defined within or external to the DBMS that access the database, and DBMS/user environment files/settings in the System Security Plan.

Record whether they do or do not contain DBMS passwords. If passwords are present, ensure that they are correctly hashed using one-way, salted hashing functions, and that the hashes are protected by host system security.

Check Contents

Redis stores and displays its user passwords in encrypted form, it also and transmits passwords as one-way hashed representations utilizing SHA256. Nevertheless, any User ID and Password stores should be verified by interviewing the database administrator (DBA).

Interview the DBA or ISSO and review any associated scripts, and applications defined within or external to the DBMS that access the database. The list must also include files, tables, or settings used to configure the operational environment for the DBMS and for interactive DBMS user accounts. Determine if any files contain database passwords. If any do, confirm that DBMS passwords stored internally or externally to the DBMS are encoded or encrypted.

If any passwords are stored in clear text, this is a finding.

Ask the DBA/system administrator (SA)/application support staff if they have created an external password store for applications, batch jobs, and scripts to use on the database server. Verify that all passwords stored there are encrypted.

If a password store is used and any password is not encrypted, this is a finding.

Vulnerability Number

V-251223

Documentable

False

Rule Version

RD6X-00-008800

Severity Override Guidance

Redis stores and displays its user passwords in encrypted form, it also and transmits passwords as one-way hashed representations utilizing SHA256. Nevertheless, any User ID and Password stores should be verified by interviewing the database administrator (DBA).

Interview the DBA or ISSO and review any associated scripts, and applications defined within or external to the DBMS that access the database. The list must also include files, tables, or settings used to configure the operational environment for the DBMS and for interactive DBMS user accounts. Determine if any files contain database passwords. If any do, confirm that DBMS passwords stored internally or externally to the DBMS are encoded or encrypted.

If any passwords are stored in clear text, this is a finding.

Ask the DBA/system administrator (SA)/application support staff if they have created an external password store for applications, batch jobs, and scripts to use on the database server. Verify that all passwords stored there are encrypted.

If a password store is used and any password is not encrypted, this is a finding.

Check Content Reference

M

Target Key

5443