TMA-REDIS-AUTHENTICATION

Ensure client authentication is required

KritičnaNivo 1Automatskaredis

Opis

Without requirepass or an ACL password on the default user, any client that can reach the port has full access. Compliant when requirepass is set or the default user is defined with a password (>pw / #hash) or is turned off. ACLs defined only in an aclfile must be reviewed separately. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).

Kako se proverava

Metod provere: Obrazac u datoteci

Datoteka: /etc/redis/redis.conf
Obrazac: (?m)^[ \t]*(?:requirepass[ \t]+\S+|user[ \t]+default[ \t][^\n]*(?:[ \t][>#]\S+|[ \t]off\b))

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set 'requirepass <long random secret>' (Redis < 6) or define ACL users with 'user <name> on ><secret> ~<keys> +@<categories>' and 'user default off' in redis.conf; restart and update clients

Svojstva

Operativni sistemi: Bilo koji
Oznake: redisdatabaseauthentication
Referenca: CIS Redis Benchmark - Authentication / requirepass and ACL (verify section number for your release)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target redis