STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must prohibit the use of cached authenticators after an organization-defined time period.

DISA Rule

SV-251224r961521_rule

Vulnerability Number

V-251224

Group Title

SRG-APP-000400-DB-000367

Rule Version

RD6X-00-009000

Severity

CAT II

CCI(s)

CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

Fix Recommendation

Configure Redis Enterprise settings to meet organizationally defined requirements. To configure the time out period, refer to Redis Enterprise Documentation:

To set time out period for authentication, log in to the RHEL server that the Redis Enterprise database is hosted on as an admin user. Escalate to root privileges.
1. Type: rladmin
2. Once rladmin is started, type: cluster config cm_session_timeout_minutes <value_to_enter>

By default, the timeout is set to 15 minutes.

Check Contents

Interview the system administrator to determine what, if any, the organizational policy is for cached authentication. By default, Redis Enterprise terminates authenticators after a user logs or times out.

To view the current time out period for authentication, log in to the RHEL server that the Redis Enterprise database is hosted on as an admin user.
1. Type: rladmin
2. Once rladmin is started, type: info cluster

Check documentation to verify that organizationally defined limits, if any, have been set. Compare documentation to actual settings found on the DB.

If the settings do not match the documentation, this is a finding.

Vulnerability Number

V-251224

Documentable

False

Rule Version

RD6X-00-009000

Severity Override Guidance

Check Content Reference

Target Key

5443