How to secure Redis Cluster?

user_618756 0
Viewed 5859

I know Redis Cluster is still unstable, but it's been passing all the unit tests since quite a long time so I started using it.

I would like to know if a Redis Cluster would work well if the nodes required authentication. I'm incline to think yes, because they connect through a different port and use a different protocol, but I'm not sure and couldn't find any documentation or anything on the spec to confirm this.

Also, if the redis cluster protocol flies over the authentication barrier, isn't it a hole in security ? Could my database be accessed by the outside world ? (the port at least must be accessible so it can talk to the other nodes)

redis sharding database-design security database
3 Answers

SSH tunnel may be an easy solution:

  1. You don't need to expose the redis port to the outside world. only the ssh one.
  2. SSH support data compression, which can reduce the transfer between data centers.

Quick Example: ssh -f -L 1234:localhost:6379 server.com -NC

This will route any incoming connection to localhost:1234 to the remote server.com:6379. So, you can replace server.com:6379 with localhost:1234 in your redis config file.

You could check man ssh for more information.

user_19430620

Redis Cluster with SSL is not possible because of the way by which Redis operates in a cluster.

For SSL to work in a Redis deployment you need to install and configure stunnel or a tunneling application.

From the Redis documentation: Note that for a Redis Cluster to work properly you need, for each node: The normal client communication port (usually 6379) used to communicate with clients to be open to all the clients that need to reach the cluster, plus all the other cluster nodes (that use the client port for keys migrations). The cluster bus port (the client port + 10000) must be reachable from all the other cluster nodes.

You can configure the stunnel to receive traffic at some port and redirect the traffic to 6379 or any other port where redis-server is listening. In cluster mode, redis-server announces its "cluster_port" so that clients and other nodes can connect to this port of connecting with it. If you override the setting "cluster_announce_port" ssl-clients will succeed in connecting to node but redis-cli and inter-node communication over cluster_port will fail.

It seems AWS ElastiCache/Redis Enterprise supports SSL with cluster but not Open Source Redis.

user_111584980
Related