TMA-REDIS-DEFAULT-USER-NOPASS
Ensure the default ACL user is not configured with nopass
CriticalLevel 1Automatedredis
Description
'user default ... nopass' explicitly allows password-less access with the default user's permissions. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).
How it is checked
Audit method: File pattern
- File
/etc/redis/redis.conf- Pattern
(?m)^[ \t]*user[ \t]+default[ \t][^\n]*\bnopass\b
How it is fixed
Fix method: Guidance or infrastructure patch
Replace nopass with '><secret>' (or turn the user off with 'user default off') in redis.conf / the aclfile and restart, or ACL SETUSER default resetpass ><secret> followed by ACL SAVE
Properties
- Operating systems
- Any
- Tags
- redisdatabaseauthentication
- Reference
- CIS Redis Benchmark - Authentication / ACL default user (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target redis