Redis
TMA-REDIS-DEFAULT-USER-NOPASS
Ensure the default ACL user is not configured with nopass
KritisLevel 1Otomatisredis
Deskripsi
'user default ... nopass' explicitly allows password-less access with the default user's permissions. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).
Cara pemeriksaan
Metode audit: Pola file
- File
/etc/redis/redis.conf- Pola
(?m)^[ \t]*user[ \t]+default[ \t][^\n]*\bnopass\b
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Replace nopass with '><secret>' (or turn the user off with 'user default off') in redis.conf / the aclfile and restart, or ACL SETUSER default resetpass ><secret> followed by ACL SAVE
Properti
- Sistem operasi
- Apa saja
- Tag
- redisdatabaseauthentication
- Referensi
- CIS Redis Benchmark - Authentication / ACL default user (verify section number for your release)
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
shell
tmaegis scan --target redis