Redis security aspect

Joe7 · February 6, 2020, 7:31pm

Hi !
Short question:
I have installed redis for file/mem-locking.
I think for security aspect setting a password (makes problem) is not necessary when protected-mode on and binding to 127.0.0.1.
Am I right ?
Thnx for answer! lg. joe

Reiner_Nippes · February 6, 2020, 9:18pm

why not to use the socket? port 0 plus

github.com

ReinerNippes/nextcloud/blob/f317cd95a5356144e9c09e2971e7890dd098536c/roles/prep_redis/files/redis.conf#L75


      
          #
          # Examples:
          #
          # bind 192.168.1.100 10.0.0.1
          bind 127.0.0.1
          
          # Specify the path for the Unix socket that will be used to listen for
          # incoming connections. There is no default, so Redis will not listen
          # on a unix socket when not specified.
          #
          unixsocket /var/run/redis/redis.sock
          unixsocketperm 770
          
          # Close the connection after a client is idle for N seconds (0 to disable)
          timeout 0
          
          # TCP keepalive.
          #
          # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence
          # of communication. This is useful for two reasons:
          #

why the password causes problem?

Joe7 · February 7, 2020, 8:50am

Thnx. But I am still using unix-socket (not TCP) ! Joe

Reiner_Nippes · February 7, 2020, 9:30am

so why did you wrote something about bind to 127.0.0.1?

port 0 turns off tcp listening.

# Accept connections on the specified port, default is 6379.
# If port 0 is specified Redis will not listen on a TCP socket.
port 0

if you’re the only “user” on the server and the permissions of the socket are correct, that should be save. (safe?)

j-ed · February 7, 2020, 10:02am

I think this is the right way to force usage of the Redis socket from within Nextcloud:

'redis' => array (
  'host' => '/var/run/redis/redis.sock',
  'port' => 0,
  'timeout' => 0.0
),

Joe7 · February 8, 2020, 9:14am

Thanks for your answer. Yes I did that (although I increased timeout value and left binding to 127.0.0.1 - binding to localhost is set per default and I didn’t change that). And so far I am the only user (testing). So I think it’s safe.
Again thanks for answering.
With kind regards, Joe