OpenControls Logo

STIG Viewer

STIGViewer Support

Redis Enterprise DBMS must recognize only system-generated session identifiers.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251237RD6X-00-010300SV-251237r961116_ruleCCI-001664medium
Description
This requirement focuses on communications protection for the DBMS session rather than for the network packet. The intent of this control is to establish grounds for confidence at each end of a communications session in the ongoing identity of the other party and in the validity of the information being transmitted. Redis Enterprise Software (RS) uses self-signed certificates out-of-the-box to make sure that sessions are secure by default. When using the default self-signed certificates, an untrusted connection notification is shown in the web UI. Depending on the browser used, the user can allow the connection for each session or add an exception to make the site trusted in future sessions.
STIGDate
Redis Enterprise 6.x Security Technical Implementation Guide2024-09-04

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09.2Unique System-Generated Session Identifiers
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AU-4(1)Transfer to Alternate Storage
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
SC-2Separation of System and User Functionality
1.00
SC-23(3)Unique System-generated Session Identifiers
1.00
SC-5Denial-of-service Protection
1.00
SC-8Transmission Confidentiality and Integrity
1.00
SC-8(2)Pre- and Post-transmission Handling
1.00

+2 more (top 10 by confidence shown)

CCI1 mapping
CCI-001664
1.00

Details

Check Text (C-251237r961116_chk)

By default, each cluster node has a different set of self-signed certificates. These certificates can be replaced with a DoD-acceptable certificate, preferably a certificate issued by an intermediate certificate authority (CA). For security reasons, Redis Enterprise only supports the TLS protocol. Therefore, verify that the Redis client or secured tunnel solution is TLS v1.2 or above. Run the following commands and verify that certificates are present: # cd /etc/opt/redislabs # ls Verify the proxy_cert.pem file is present. If no certificates are present, this is a finding.

Fix Text (F-54626r804900_fix)

To configure TLS and configure only organizationally defined CA-signed certificates, refer to the following document: https://docs.redislabs.com/latest/rs/administering/cluster-operations/updating-certificates/