TMA-REDIS-AUTHENTICATION
Ensure client authentication is required
CriticalLevel 1Automatedredis
Description
Without requirepass or an ACL password on the default user, any client that can reach the port has full access. Compliant when requirepass is set or the default user is defined with a password (>pw / #hash) or is turned off. ACLs defined only in an aclfile must be reviewed separately. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).
How it is checked
Audit method: File pattern
- File
/etc/redis/redis.conf- Pattern
(?m)^[ \t]*(?:requirepass[ \t]+\S+|user[ \t]+default[ \t][^\n]*(?:[ \t][>#]\S+|[ \t]off\b))
How it is fixed
Fix method: Guidance or infrastructure patch
Set 'requirepass <long random secret>' (Redis < 6) or define ACL users with 'user <name> on ><secret> ~<keys> +@<categories>' and 'user default off' in redis.conf; restart and update clients
Properties
- Operating systems
- Any
- Tags
- redisdatabaseauthentication
- Reference
- CIS Redis Benchmark - Authentication / requirepass and ACL (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target redis