Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use of ACLs instead of rename-command in Redis Config #1558

Open
wRkA opened this issue Oct 11, 2024 · 0 comments
Open

Use of ACLs instead of rename-command in Redis Config #1558

wRkA opened this issue Oct 11, 2024 · 0 comments

Comments

@wRkA
Copy link

wRkA commented Oct 11, 2024

The rename-command option in Redis is obsolete and can lead to insecure configurations. This may compromise command permissions management in shared environments.

Describe the solution you'd like
Add new check for Redis configuration to prioritize the use of ACLs instead of rename-command, facilitating command permission management.

Required changes
Promote the use of ACLs and eliminate reliance on rename-command.

Context
Since Redis 6.2 supports the use of ACLs for managing permissions, providing a more secure and effective control over access to commands.

Additional information
redis.conf

# Command renaming (DEPRECATED).
#
# ------------------------------------------------------------------------
# WARNING: avoid using this option if possible. Instead use ACLs to remove
# commands from the default user, and put them only in some admin user you
# create for administrative purposes.
# ------------------------------------------------------------------------
#
# It is possible to change the name of dangerous commands in a shared
# environment. For instance the CONFIG command may be renamed into something
# hard to guess so that it will still be available for internal-use tools
# but not available for general clients.
#
# Example:
#
# rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52
#
# It is also possible to completely kill a command by renaming it into
# an empty string:
#
# rename-command CONFIG ""
#
# Please note that changing the name of commands that are logged into the
# AOF file or transmitted to replicas may cause problems.

Thank you for your work on this project.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant