STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-251225r961038_rule

Vulnerability Number

V-251225

Group Title

SRG-APP-000175-DB-000067

Rule Version

RD6X-00-009100

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Configure Redis Enterprise settings to meet organizationally defined requirements.

1. Replace the RS server default certificates and key on all nodes with the CA-signed certificate and restart the proxy.

To replace certificates using the rladmin CLI, run:
rladmin cluster certificate set <cert-name> certificate_file <cert-file-name>.pem key_file <key-file-name>.pem
Where:
cert-name - The certificate name to replace:
For management UI: cm
For REST API: api
For database endpoint: proxy
For syncer: syncer
For metrics exporter: metrics_exporter
cert-file-name - The name of the certificate file
key-file-name - The name of the key file

Note: A certificate for the databases' endpoint should be assigned for the same domain as the cluster name. For example, for a cluster with the name "redislabs.com" the certificate should be for "*.redislabs.com".

2. Add the TLS client certificates in the UI including CA certificates and any intermediate certificates by chaining the certificate into one file (can use a cat command to chain the certificates).

3. On the client side, make sure to import and trust the CA and intermediate certificates (CA certificates can be chained with intermediate as one file to use and import).

Check Contents

At this time, Redis Enterprise does not support OSCP and is partially compliant with RFC 5280. Verify that the host operating system is encrypted.

If the host operating system is not encrypted or STIG-compliant, this is a finding.

To test, have the user log in to the database. If certificates are not being validated by performing RFC 5280-compliant certification path validation (i.e., "pop up" certificate validation), this is a finding.

If the host operating system is encrypted, run the following commands and verify that only DoD-approved PKI certificates are present and used for Redis Enterprise:
# cd /etc/opt/redislabs
# cat proxy_cert.pem

If no DoD-approved certificates are found, this is a finding.

Vulnerability Number

V-251225

Documentable

False

Rule Version

RD6X-00-009100

Severity Override Guidance

At this time, Redis Enterprise does not support OSCP and is partially compliant with RFC 5280. Verify that the host operating system is encrypted.

If the host operating system is not encrypted or STIG-compliant, this is a finding.

To test, have the user log in to the database. If certificates are not being validated by performing RFC 5280-compliant certification path validation (i.e., "pop up" certificate validation), this is a finding.

If the host operating system is encrypted, run the following commands and verify that only DoD-approved PKI certificates are present and used for Redis Enterprise:
# cd /etc/opt/redislabs
# cat proxy_cert.pem

If no DoD-approved certificates are found, this is a finding.

Check Content Reference

M

Target Key

5443