topic Re: Redis security requirepass in Security

Redis security requirepass

weicc84 — Mon, 29 Jan 2024 15:49:14 GMT

My company flagged redis being vulnerable to security because requirepass is not enabled. How do I enable it and give the password to the clients that connect to the redis?

Re: Redis security requirepass

PickleRick — Thu, 01 Feb 2024 17:02:51 GMT

OK, and how is your question connected to Splunk?

Re: Redis security requirepass

weicc84 — Thu, 01 Feb 2024 18:08:15 GMT

I'm assuming the redis is packaged with your product. Here is the process we run. The splunk id could've been anything. However, the team that manages splunk platform in VZW also uses id splunk to identity original source software. I talked to the splunk team in VZW and he directed me to here.

1. Do you have redis included in one of the splunk products.

If yes, please show us how to set the password in one of the clients that connects to redis.

splunk    3839     1  0 Dec05 ?        00:31:12 splunkd -p 8089 start
splunk    3845  3839  0 Dec05 ?        00:00:00 [splunkd pid=3839] splunkd -p 8089 start [process-runner]
splunk   24625 24266  0 Dec06 pts/5    00:00:26 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   24631 24266  0 Dec06 pts/5    00:08:20 php k2_serverDaemon.php
splunk   24637 24266  0 Dec06 pts/5    00:04:48 php k2_serverMonitor.php
splunk   24643 24266  0 Dec06 pts/5    00:28:43 redis-server *:6379
splunk   24666 24625  0 Dec06 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   24667 24625  0 Dec06 pts/5    00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   24668 24625  0 Dec06 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   24669 24625  0 Dec06 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   24670 24625  0 Dec06 pts/5    00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   26301 24625  0 Dec07 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   26825 24625  0 Dec07 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   46601 24625  0 Dec07 pts/5    00:00:02 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
splunk   52124 24625  0 Dec07 pts/5    00:00:01 httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf

Re: Redis security requirepass

PickleRick — Thu, 01 Feb 2024 19:16:19 GMT

No. Splunk distribution does not include redis. Just as it doesn't include Apache httpd. Just because there are several processes on your box running with the same user that is used to run Splunk doesn't necessarily mean they are one software package.

Your listing shows that indeed splunk user is used to run several pieces of software but they are independent of Splunk and you should rather ask the person who deployed your server what is going on there (typically you don't use other stuff as splun user so it's a relatively unusual situation).

Re: Redis security requirepass

weicc84 — Thu, 01 Feb 2024 19:25:28 GMT

Thank you.