topic Re: What does the redis-server process do for PAN-OS? in General Topics

What does the redis-server process do for PAN-OS?

jasonroy — Mon, 16 Oct 2023 21:02:33 GMT

I'm documenting new services in PAN-OS present in 10.x. What does the redis-server process do? It appears to bind to tcp/6378 and tcp/6380 (if only accessible "internally"). I do not see this service described in the Commonly Used Processes/Daemons url found here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO

Re: What does the redis-server process do for PAN-OS?

BPry — Mon, 16 Oct 2023 21:12:25 GMT

@jasonroy,

Fairly positive there's a number of databases in play and not just one. I know that it's used to house User-ID with the key being the IP and the value being the username. Fairly positive that's not the only place it's utilized however.

Also should note that this started showing up in the 9.0 OSS listings. Pretty positive it was in use before that however and the listing is likely due to them changing their licensing around the same time 9.0 was actually released. Redis Labs modified their licensing a number of times around this release.

Re: What does the redis-server process do for PAN-OS?

jasonroy — Mon, 16 Oct 2023 21:24:50 GMT

Generic Internet searches found this, but I'd like to hear officially from Palo Alto: https://redis.io/docs/about/

Re: What does the redis-server process do for PAN-OS?

jasonroy — Mon, 16 Oct 2023 22:52:27 GMT

Perhaps it was there before as a service in 9.x, but it wasn't binding a port until 10.x. Or perhaps only if something utilizing matching/tracking User-ID to IP (which we're not).