If redis is deployed on the intranet and cannot be accessed by external machines, then the following content does not need to be read.
If redis is deployed on the public network, let’s take a look. The recent redis security incidents are quite serious, and most machines have even been hacked.
There are several ways to set up security:
1. Set a password
requirepass yourpassword
Configured in redis, the password is in plain text. At this time, other clients need to bind the password to access redis. The execution efficiency of Redis is very fast, and external devices can test a considerable number of passwords per second. Redis passwords are stored in the Redis.conf file and in the configuration of the internal client, so they do not need to be remembered by the administrator. So a rather long password can be used.
If a password is set, the master redis database password of the response should also be configured during master-slave replication.
2. Bind ip
bind ip
You can set binding fixed ip access, you can also bind multiple ip
bind ip1 ip2 #There is a space in the middle
If ip is bound, when master-slave replication, also bind the ip of the slave redis database server
3. Disable special commands
It is possible to disable some Redis commands, or rename them. This way the request from the client can only execute a limited number of commands.
In this case it is possible to rename the command from the command table or hide the command entirely. This feature can be used as a declaration in the Redis.conf configuration file. E.g:
rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52
4. Modify the default port number
port 9001
In fact, don't look down on this method. In recent redis security incidents, most of the hackers are the default port of 6379. If you modify the port slightly, it will be much safer.
5. Do not use root privileges at startup
Even if redis is cracked, it only obtains the permission to start the redis user, but it is best not to use root to start redis. Once redis is hacked, the root privileges of the server are obtained and it is over.