Ensure FLUSHALL and FLUSHDB are renamed or blocked

中级别 2自动化redis

说明

FLUSHALL/FLUSHDB destroy all data in one command. Compliant when rename-command FLUSHALL is set or the default ACL user has -@dangerous / -flushall. Checks /etc/redis/redis.conf (SKIP when it does not exist; RHEL uses /etc/redis.conf).

检查方式

审计方法: 文件正则匹配

文件: /etc/redis/redis.conf
匹配模式: (?mi)^[ \t]*(?:rename-command[ \t]+['\x22]?flushall['\x22]?[ \t]+\S+|user[ \t]+default[ \t][^\n]*(?:-@dangerous|-flushall)\b)

修复方式

修复方法: 操作指南或基础设施补丁

Add 'rename-command FLUSHALL ""' and 'rename-command FLUSHDB ""' to redis.conf (or use ACLs -@dangerous) and restart Redis

属性

操作系统: 任意
标签: redisdatabasesurface-reduction
参考: CIS Redis Benchmark - Command Hardening / Dangerous Commands (verify section number for your release)

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target redis --level 2