CIS Redis 7 Benchmark

This recommendation verifies that redis Runs Under a Dedicated User Account on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to redis Runs Under a Dedicated User Account may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps -ef | grep redis-server | grep -v grep
# Should show 'redis' user, not root

useradd --system --no-create-home --shell /usr/sbin/nologin redis
chown redis:redis /etc/redis/redis.conf
# Update systemd unit to run as redis user

This recommendation verifies that redis Is Installed from Official Source on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to redis Is Installed from Official Source may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-server --version
# Verify version ≥ 7.0 from official redis.io or OS package repo

# Use official Redis repo:
# https://redis.io/docs/install/install-redis/install-redis-on-linux/

This recommendation verifies that redis Is Running the Latest Stable Version on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to redis Is Running the Latest Stable Version may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-server --version
redis-cli INFO server | grep redis_version

# Update to latest stable:
apt update && apt upgrade redis-server
# or compile from source at https://redis.io/download

The ownership of redis.conf should be set to redis and Mode 640. Correct file and directory ownership prevents unauthorized modification and maintains the integrity of the Redis 7 in-memory data store configuration.

Incorrect ownership of redis.conf may allow unauthorized users to modify critical configuration or executable files. Ensuring correct ownership is essential for maintaining the integrity of the Redis 7 in-memory data store.

stat -c "%U:%G %a" /etc/redis/redis.conf
# Expected: redis:redis 640

chown redis:redis /etc/redis/redis.conf
chmod 640 /etc/redis/redis.conf

This setting ensures that Data Directory Permissions is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Data Directory Permissions could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

stat -c "%U:%G %a" /var/lib/redis
# Expected: redis:redis 750

chown redis:redis /var/lib/redis
chmod 750 /var/lib/redis

This setting ensures that Log File Permissions is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Log File Permissions could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

stat -c "%U:%G %a" /var/log/redis/redis-server.log
# Expected: redis:redis 640

chown redis:redis /var/log/redis/redis-server.log
chmod 640 /var/log/redis/redis-server.log

This setting controls whether Authentication is enabled on the Redis 7 in-memory data store. Enabling this feature strengthens the security posture by enforcing the recommended configuration via redis.conf, redis-cli, or Redis Sentinel configuration.

Without Authentication enabled, the Redis 7 in-memory data store may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

redis-cli CONFIG GET requirepass
# Value should not be empty
redis-cli PING
# Should return NOAUTH if auth is required

# In redis.conf:
requirepass <strong-password>

# Or use ACL (preferred in Redis 7):
user default on ><strong-password-hash> ~* &* +@all

Redis is extremely fast and can test 1M+ passwords/sec on modern hardware. Use passwords ≥ 32 characters.

Failure to password Is Strong (≥ 32 Characters) may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify password length in redis.conf or ACL file
grep -E "^requirepass" /etc/redis/redis.conf | awk '{print length($2), "chars"}'

# Generate a strong password:
openssl rand -hex 32
# Set in redis.conf:
requirepass <64-char-hex-string>

This recommendation verifies that aCLs Are Used Instead of Legacy requirepass on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aCLs Are Used Instead of Legacy requirepass may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli ACL LIST
# Verify multiple users with appropriate permissions

# Use external ACL file:
# In redis.conf:
aclfile /etc/redis/users.acl

# In /etc/redis/users.acl:
user admin on ><hash> ~* &* +@all
user readonly on ><hash> ~* &* +@read -@write -@admin -@dangerous
user default off

This recommendation verifies that the Default User Is Restricted or Disabled on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Default User Is Restricted or Disabled may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli ACL GETUSER default
# Verify 'off' flag or restricted permissions

redis-cli ACL SETUSER default off
redis-cli ACL SAVE

This setting ensures that ACL File Permissions is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted ACL File Permissions could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

stat -c "%U:%G %a" /etc/redis/users.acl
# Expected: redis:redis 640

chown redis:redis /etc/redis/users.acl
chmod 640 /etc/redis/users.acl

This recommendation verifies that redis Is Bound to Specific Interfaces on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to redis Is Bound to Specific Interfaces may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET bind
grep "^bind" /etc/redis/redis.conf
# Should NOT be 0.0.0.0 or empty

# In redis.conf:
bind 127.0.0.1 -::1

This setting controls whether Protected Mode is enabled on the Redis 7 in-memory data store. Enabling this feature strengthens the security posture by enforcing the recommended configuration via redis.conf, redis-cli, or Redis Sentinel configuration.

Without Protected Mode enabled, the Redis 7 in-memory data store may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

redis-cli CONFIG GET protected-mode
# Value should be "yes"

# In redis.conf:
protected-mode yes

This recommendation verifies that non-Default Port Is Used on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to non-Default Port Is Used may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET port
grep "^port" /etc/redis/redis.conf

# In redis.conf:
port 16379

This recommendation verifies that tLS Is Enabled for Client Connections on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Enabled for Client Connections may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET tls-port
redis-cli CONFIG GET tls-cert-file

# In redis.conf:
port 0
tls-port 6379
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt
tls-auth-clients yes

This setting enforces that TLS Version ≥ 1.2 is required on the Redis 7 in-memory data store. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to tLS Version ≥ 1.2 Is Required may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET tls-protocols

# In redis.conf:
tls-protocols "TLSv1.2 TLSv1.3"

This setting controls whether Weak Cipher Suites is disabled on the Redis 7 in-memory data store. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Weak Cipher Suites enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Redis 7 in-memory data store.

redis-cli CONFIG GET tls-ciphers
redis-cli CONFIG GET tls-ciphersuites

# In redis.conf:
tls-ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
tls-ciphersuites "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

This setting ensures that FLUSHALL and FLUSHDB is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted FLUSHALL and FLUSHDB could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

# Check ACL for non-admin users:
redis-cli ACL GETUSER <username>
# Verify -@dangerous or explicit -flushall -flushdb

# Via ACL:
ACL SETUSER appuser on ><hash> ~app:* +@all -@dangerous
ACL SAVE

# Or rename commands (legacy):
rename-command FLUSHALL ""
rename-command FLUSHDB ""

This setting ensures that CONFIG Command is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted CONFIG Command could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

# Non-admin users should not have CONFIG:
redis-cli -u <appuser> CONFIG GET bind
# Should return NOPERM error

ACL SETUSER appuser -config
ACL SAVE

This setting ensures that DEBUG and KEYS Commands is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted DEBUG and KEYS Commands could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

# Non-admin users should not have DEBUG/KEYS:
redis-cli -u <appuser> KEYS "*"
# Should return NOPERM

# Use SCAN instead of KEYS in applications
ACL SETUSER appuser -debug -keys
ACL SAVE

# Or rename (legacy):
rename-command DEBUG ""
rename-command KEYS ""

This setting ensures that SHUTDOWN Command is restricted on the Redis 7 in-memory data store. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted SHUTDOWN Command could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Redis 7 in-memory data store is essential for defense in depth.

redis-cli ACL GETUSER <appuser>
# Verify -shutdown in permissions

ACL SETUSER appuser -shutdown
ACL SAVE

This recommendation addresses the proper configuration of Lua Scripting Timeout on the Redis 7 in-memory data store. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Lua Scripting Timeout can lead to security gaps that may be exploited by attackers. A properly configured Redis 7 in-memory data store reduces exposure to both known vulnerabilities and configuration drift.

redis-cli CONFIG GET lua-time-limit
# Default: 5000 ms

# In redis.conf:
lua-time-limit 5000

This recommendation verifies that only Approved Modules Are Loaded on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to only Approved Modules Are Loaded may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli MODULE LIST
# Review each loaded module

# Remove unapproved modules from redis.conf:
# loadmodule /path/to/module.so  ← comment out
# Restart Redis

This recommendation verifies that enable-debug-command Is 'no' on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to enable-debug-command Is 'no' may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "enable-debug-command" /etc/redis/redis.conf

# In redis.conf:
enable-debug-command no

This recommendation verifies that rDB Snapshot Files Are Protected on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rDB Snapshot Files Are Protected may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET dbfilename
redis-cli CONFIG GET dir
ls -la /var/lib/redis/dump.rdb
# File should be owned by redis:redis, mode 640

chown redis:redis /var/lib/redis/dump.rdb
chmod 640 /var/lib/redis/dump.rdb

This setting enforces that AOF Persistence Is Enabled If is required on the Redis 7 in-memory data store. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to aOF Persistence Is Enabled If Required may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET appendonly
redis-cli CONFIG GET appendfsync

# In redis.conf:
appendonly yes
appendfsync everysec

This setting controls whether RDB Checksum Validation is enabled on the Redis 7 in-memory data store. Enabling this feature strengthens the security posture by enforcing the recommended configuration via redis.conf, redis-cli, or Redis Sentinel configuration.

Without RDB Checksum Validation enabled, the Redis 7 in-memory data store may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

redis-cli CONFIG GET rdbchecksum
# Value should be "yes"

# In redis.conf:
rdbchecksum yes

This recommendation verifies that replication Uses Authentication on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to replication Uses Authentication may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET masterauth
redis-cli CONFIG GET masteruser
# Both should be set on replicas

# On replica redis.conf:
masteruser repl_user
masterauth <strong-password>

# On master, create replication ACL:
ACL SETUSER repl_user on ><hash> +psync +replconf +ping

This recommendation verifies that replicas Are Read-Only on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to replicas Are Read-Only may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET replica-read-only
# Value should be "yes"

# In redis.conf:
replica-read-only yes

This recommendation verifies that tLS Is Used for Replication Traffic on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tLS Is Used for Replication Traffic may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET tls-replication

# In redis.conf:
tls-replication yes

This recommendation configures Log Level to 'notice' or Higher on the Redis 7 in-memory data store. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for Log Level could weaken security controls or allow unintended behavior. Setting this to 'notice' or Higher ensures the Redis 7 in-memory data store operates within a well-defined security boundary.

redis-cli CONFIG GET loglevel
# Should be "notice" or "warning"

# In redis.conf:
loglevel notice

This recommendation addresses the proper configuration of Logging to a File on the Redis 7 in-memory data store. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Logging to a File can lead to security gaps that may be exploited by attackers. A properly configured Redis 7 in-memory data store reduces exposure to both known vulnerabilities and configuration drift.

redis-cli CONFIG GET logfile
# Should not be empty ("")

# In redis.conf:
logfile /var/log/redis/redis-server.log

This recommendation addresses the proper configuration of Syslog Integration on the Redis 7 in-memory data store. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Syslog Integration can lead to security gaps that may be exploited by attackers. A properly configured Redis 7 in-memory data store reduces exposure to both known vulnerabilities and configuration drift.

redis-cli CONFIG GET syslog-enabled

# In redis.conf:
syslog-enabled yes
syslog-ident redis
syslog-facility local0

This recommendation addresses the proper configuration of Slowlog on the Redis 7 in-memory data store. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Slowlog can lead to security gaps that may be exploited by attackers. A properly configured Redis 7 in-memory data store reduces exposure to both known vulnerabilities and configuration drift.

redis-cli CONFIG GET slowlog-log-slower-than
redis-cli CONFIG GET slowlog-max-len

# In redis.conf:
slowlog-log-slower-than 10000
slowlog-max-len 128

This recommendation verifies that maxclients Is Set Appropriately on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to maxclients Is Set Appropriately may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET maxclients

# In redis.conf (set based on expected load):
maxclients 10000

This recommendation verifies that maxmemory Is Set on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to maxmemory Is Set may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET maxmemory
# Should not be 0 (unlimited)

# In redis.conf:
maxmemory 4gb
maxmemory-policy allkeys-lru

This recommendation configures the timeout for Client on the Redis 7 in-memory data store. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to client Timeout Is Set may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET timeout
# Should not be 0

# In redis.conf:
timeout 300

This recommendation verifies that tCP Keepalive Is Set on the Redis 7 in-memory data store. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to tCP Keepalive Is Set may leave the Redis 7 in-memory data store vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

redis-cli CONFIG GET tcp-keepalive
# Should be > 0 (recommended 300)

# In redis.conf:
tcp-keepalive 300