KB485399: "The Redis server running on env-xxxxxxxxxx (xx.xxx.xxx.xxx) is not protected by password authentication” error occurs in MicroStrategy Platform Analytics

Symptom

Below error message received in Vulnerability Scan Report suggests Redis server security is compromised. 
"The Redis server running on env-xxxxxxxxxx (xx.xxx.xxx.xxx) is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server. Please enable the 'requirepass' directive in the redis.conf configuration file." 
Corresponding link below provides the vulnerability description and suggested fix: 
Error: Redis Server Unprotected by Password Authentication Vulnerability details:
https://www.tenable.com/plugins/nessus/100634
Solution: Enable the 'requirepass' directive in the redis.conf configuration file.
Enable the 'requirepass’ by updating the redis.cong from # requirepass foobared to requirepass myRedis , but Platform Analytics Health Check failed for Redis as shown below:
 [mstr@xxxxxx Redis]$ ./redis.sh status Redis is running. 
************************** Health Check Summary ********************************* 
Platform Analytics Warehouse PASS 
Platform Analytics Redis Server FAIL 
Platform Analytics Kafka Cluster PASS

Cause

After adding the "requirepass" parameter in redis.conf, password need to be encrypted using the encryptor tool and add it to the PAConsumerConfig.yaml file for the Consumer to be able to authenticate to Redis.

Action

Refer to steps below to encrypt the password:

1. In the Platform Analytics directory, located at /opt/MicroStrategy/PlatformAnalytics, open the bin folder and run the following commands:

./platform-analytics-consumer.sh stop

./platform-analytics-usher-lookup-producer.sh stop

 

1. In the Platform Analytics directory, open the bin folder.
2. Run the following script:

[user@your-PA-machine bin]#./platform-analytics-encryptor.sh

 

1. Enter your new password to generate an encrypted password.
2. Record the encrypted password.
3. In the Platform Analytics directory, open the conf folder.
4. Edit the PAConsumerConfig.yaml file and update the redisPassword: field with the encrypted password. One space is needed after 'redisPassword:'

example:

redisPassword: c5eoCdW023nqmME9Nl2ZBntw5MdvBZEOQLd9zD6xVWSx3UjE,EnrazzMgibZDpHD

 

1. Save the file.
2. In the Platform Analytics directory, open the bin folder and run the following commands:

./platform-analytics-consumer.sh start./platform-analytics-usher-lookup-producer.sh start

 
Product manual for details:
https://www2.microstrategy.com/producthelp/Current/PlatformAnalytics/en-us/Content/enable_password_authentication_telemetry_cache.htm
Further Readings on Redis authentication: 
https://redis.io/commands/auth
Third Party Software Installation WARNING
The third-party product(s) discussed in this technical note is manufactured by vendors independent of Strategy. Strategy makes no warranty, express, implied or otherwise, regarding this product, including its performance or reliability.