Redis 网络安全

Welcome! Redis is super fast, but by default, it's designed for speed, not maximum security. This lesson focuses on protecting your Redis instance from network threats.

We'll explore how to use firewalls, bind Redis to specific network interfaces, and enable encryption (TLS/SSL) to keep your data safe.

A firewall acts like a gatekeeper for your server's network traffic. It controls which connections are allowed in and out, based on rules you define.

• Block unwanted access: Prevent unauthorized users or applications from even reaching your Redis port.
• Principle of Least Privilege: Only allow traffic from known, trusted sources.

Always configure a firewall for your Redis server.

If you're using a Linux server, tools like ufw (Uncomplicated Firewall) make configuration easy. Here's how to allow connections only from a specific IP address (192.168.1.100) to Redis's default port (6379):

By default, Redis might listen for connections on all available network interfaces (0.0.0.0). This means it's accessible from any network segment your server is connected to.

To enhance security, you should bind Redis to a specific IP address, usually the one on your private network or localhost, preventing external access.

You can change Redis's bind address in its configuration file, typically redis.conf. Find the bind directive and set it to your desired IP address. If you want Redis to only be accessible from the same server, use 127.0.0.1 (localhost).

While firewalls and IP binding restrict who can connect, TLS/SSL (Transport Layer Security / Secure Sockets Layer) encrypts what is sent over the network.

This prevents eavesdropping and tampering of data, crucial for sensitive information. Redis supports TLS starting from version 6.

To enable TLS, you need a few things:

• A valid SSL/TLS certificate (.crt or .pem file)
• A private key (.key file)
• Optionally, a Certificate Authority (CA) file if your certificate is not self-signed or from a well-known CA.

These files are configured in redis.conf.

Here's how you might configure TLS in your redis.conf. Make sure to replace the placeholder paths with your actual certificate and key file locations.

Beyond individual server settings, consider network segmentation. This means placing your Redis instance in a dedicated, isolated network segment (e.g., a private subnet or VLAN).

• Only application servers that need to talk to Redis should be allowed into this segment.
• It adds another layer of isolation, making it harder for attackers to reach Redis even if they compromise other parts of your infrastructure.

Great job! You've learned how to harden your Redis instance against network threats.

• Firewalls are essential for controlling inbound and outbound traffic.
• Binding Redis to specific IP addresses (like 127.0.0.1) restricts where it listens.
• TLS/SSL encrypts data in transit, protecting against eavesdropping.
• Network segmentation provides an additional layer of isolation.

Always use a combination of these strategies for robust Redis security!