You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The rename-command option in Redis is obsolete and can lead to insecure configurations. This may compromise command permissions management in shared environments.
Describe the solution you'd like
Add new check for Redis configuration to prioritize the use of ACLs instead of rename-command, facilitating command permission management.
Required changes
Promote the use of ACLs and eliminate reliance on rename-command.
Context
Since Redis 6.2 supports the use of ACLs for managing permissions, providing a more secure and effective control over access to commands.
Additional information
redis.conf
# Command renaming (DEPRECATED).
#
# ------------------------------------------------------------------------
# WARNING: avoid using this option if possible. Instead use ACLs to remove
# commands from the default user, and put them only in some admin user you
# create for administrative purposes.
# ------------------------------------------------------------------------
#
# It is possible to change the name of dangerous commands in a shared
# environment. For instance the CONFIG command may be renamed into something
# hard to guess so that it will still be available for internal-use tools
# but not available for general clients.
#
# Example:
#
# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52
#
# It is also possible to completely kill a command by renaming it into
# an empty string:
#
# rename-command CONFIG ""
#
# Please note that changing the name of commands that are logged into the
# AOF file or transmitted to replicas may cause problems.
Thank you for your work on this project.
The text was updated successfully, but these errors were encountered:
The
rename-command
option in Redis is obsolete and can lead to insecure configurations. This may compromise command permissions management in shared environments.Describe the solution you'd like
Add new check for Redis configuration to prioritize the use of ACLs instead of rename-command, facilitating command permission management.
Required changes
Promote the use of ACLs and eliminate reliance on rename-command.
Context
Since Redis 6.2 supports the use of ACLs for managing permissions, providing a more secure and effective control over access to commands.
Additional information
redis.conf
Thank you for your work on this project.
The text was updated successfully, but these errors were encountered: