STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

DISA Rule

SV-251229r961050_rule

Vulnerability Number

V-251229

Group Title

SRG-APP-000179-DB-000114

Rule Version

RD6X-00-009500

Severity

CAT I

CCI(s)

CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

Fix Recommendation

Configure Redis Enterprise settings to use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations. To set the minimum TLS version that can be used for encrypting the data in transit between a Redis client and a Redis Enterprise cluster, use the REST API or the following rladmin command:
rladmin> cluster config min_data_TLS_version <version> (e.g., 1.2)

Ensure that openssl is on the latest version as required by organizational policies to be FIPS compliant.

Check Contents

Review the Redis Enterprise configuration to verify it is using NIST FIPS validated cryptographic modules for cryptographic operations. Redis Enterprise uses TLS 1.2 and has a cyber suite of options that is configurable through the rladmin, REST API, and on the Redis Enterprise web UI.

Verify the host operating system is encrypted.

If the host operating system is not encrypted, this is a finding.

If the host operating system is encrypted, run the following commands and verify that only DoD-approved PKI certificates are present:
# cd /etc/opt/redislabs
# ls

Verify the following file is present: proxy_cert.pem

If no certificates are present, this is a finding.

Verify TLS is configured to be used. To check this:
1. Log in to the Redis Enterprise web UI as an admin user.
2. Navigate to the Databases tab and select the database and then configuration.
3. Review the configuration and verify that TLS is enabled for all communications.

If TLS is not configured to be used, this is a finding.

To check the current TLS version, run the following commands on one of the servers that is hosting Redis Enterprise as a privileged user:
# ccs-cli
# hgetall min_control_tls_version

If TLS is not FIPS compliant, this is a finding.

To validate the openssl version, run the following command on one of the servers that is hosting Redis Enterprise as a privileged user:
# openssl version

If NIST FIPS validated modules are not being used for all cryptographic operations, this is a finding.

Vulnerability Number

V-251229

Documentable

False

Rule Version

RD6X-00-009500

Severity Override Guidance

Check Content Reference

Target Key

5443