STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must recognize only system-generated session identifiers.

DISA Rule

SV-251237r961116_rule

Vulnerability Number

V-251237

Group Title

SRG-APP-000223-DB-000168

Rule Version

RD6X-00-010300

Severity

CAT II

CCI(s)

• CCI-001664 - Recognize only session identifiers that are system-generated.

Weight

10

Fix Recommendation

To configure TLS and configure only organizationally defined CA-signed certificates, refer to the following document:
https://docs.redislabs.com/latest/rs/administering/cluster-operations/updating-certificates/

Check Contents

By default, each cluster node has a different set of self-signed certificates. These certificates can be replaced with a DoD-acceptable certificate, preferably a certificate issued by an intermediate certificate authority (CA).

For security reasons, Redis Enterprise only supports the TLS protocol. Therefore, verify that the Redis client or secured tunnel solution is TLS v1.2 or above.

Run the following commands and verify that certificates are present:
# cd /etc/opt/redislabs
# ls

Verify the proxy_cert.pem file is present.

If no certificates are present, this is a finding.

Vulnerability Number

V-251237

Documentable

False

Rule Version

RD6X-00-010300

Severity Override Guidance

By default, each cluster node has a different set of self-signed certificates. These certificates can be replaced with a DoD-acceptable certificate, preferably a certificate issued by an intermediate certificate authority (CA).

For security reasons, Redis Enterprise only supports the TLS protocol. Therefore, verify that the Redis client or secured tunnel solution is TLS v1.2 or above.

Run the following commands and verify that certificates are present:
# cd /etc/opt/redislabs
# ls

Verify the proxy_cert.pem file is present.

If no certificates are present, this is a finding.

Check Content Reference

M

Target Key

5443