Ensure client authentication is required

KritisLevel 1Otomatisredis

Deskripsi

Without requirepass or an ACL password on the default user, any client that can reach the port has full access. Compliant when requirepass is set or the default user is defined with a password (>pw / #hash) or is turned off. ACLs defined only in an aclfile must be reviewed separately. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).

Cara pemeriksaan

Metode audit: Pola file

File: /etc/redis/redis.conf
Pola: (?m)^[ \t]*(?:requirepass[ \t]+\S+|user[ \t]+default[ \t][^\n]*(?:[ \t][>#]\S+|[ \t]off\b))

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set 'requirepass <long random secret>' (Redis < 6) or define ACL users with 'user <name> on ><secret> ~<keys> +@<categories>' and 'user default off' in redis.conf; restart and update clients

Properti

Sistem operasi: Apa saja
Tag: redisdatabaseauthentication
Referensi: CIS Redis Benchmark - Authentication / requirepass and ACL (verify section number for your release)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target redis