Redis开启ACL认证

概述

Redis开启ACL认证，同时限制危险命令

环境

操作系统：Centos7.9
Redis-server：7.2.5

配置

创建acl配置文件

bash 复制代码

cd /usr/local/redis/

添加users.acl文件

bash 复制代码

vim users.acl

Redis7.2.5不支持注释行（需要Redis8.8+以上版本才行），说明见下
生成密码hash的命令 echo -n 'password' | sha256sum
账号启用on，账号禁止off

bash 复制代码

user default on #993bdce878f6b476fc4f5c1403301067ec626e61e8f7229a871ea049f8ad90e1 ~* &* +@all
user admin on #daf9b6d3b2a62dceadf6e76f9be380d464cca3323bb95063f4d6f9cb3696f02b ~* &* +@all -@dangerous

配置文件说明如下

bash 复制代码

# ============================================
# Redis ACL 配置文件
# 格式：user <用户名> <规则1> <规则2> ...
# 需要Redis8.8+ 版本才支持注释
# ============================================

# 默认用户：保留原有 requirepass 密码，权限不变
user default on，#密码hash 使用密文  #993bdce878f6b476fc4f5c1403301067ec626e61e8f7229a871ea049f8ad90e1 ~* &* +@all

# 新增 admin 账号：启用，独立密码，全权限（按需调整）,去除危险命令。查看危险命令使用ACL CAT dangerous
user admin on #daf9b6d3b2a62dceadf6e76f9be380d464cca3323bb95063f4d6f9cb3696f02b ~* &* +@all -@dangerous

# 只读用户示例, >readpass 使用明文密码
#user readonly on >readpass ~* +@read -@dangerous

# 受限用户示例：只能访问 app1: 前缀的键
#user app1_user on >app1pass ~app1:* &events:* +@read +@write -@dangerous

修改redis.conf文件

启用 aclfile
注释 requirepass

bash 复制代码

# Using an external ACL file
#
# Instead of configuring users here in this file, it is possible to use
# a stand-alone file just listing users. The two methods cannot be mixed:
# if you configure users here and at the same time you activate the external
# ACL file, the server will refuse to start.
#
# The format of the external ACL user file is exactly the same as the
# format that is used inside redis.conf to describe users.
#
 aclfile /usr/local/redis/users.acl

# IMPORTANT NOTE: starting with Redis 6 "requirepass" is just a compatibility
# layer on top of the new ACL system. The option effect will be just setting
# the password for the default user. Clients will still authenticate using
# AUTH <password> as usually, or more explicitly with AUTH default <password>
# if they follow the new protocol: both will work.
#
# The requirepass is not compatible with aclfile option and the ACL LOAD
# command, these will cause requirepass to be ignored.
#
# requirepass yourpassword

生效

重启服务

bash 复制代码

systemctl restart redis-server

登录验证

验证默认账号（default）登录

格式： auth 默认账号的密码

bash 复制代码

redis-cli 
127.0.0.1:6379> auth defaultpassword
OK

验证admin账号登录

格式： auth 账号账号的密码

bash 复制代码

redis-cli 
127.0.0.1:6379> auth admin adminpassword
OK

查看危险命令

登录Redis后

bash 复制代码

127.0.0.1:6379> ACL CAT dangerous
 1) "cluster|forget"
 2) "cluster|replicas"
 3) "cluster|reset"
 4) "cluster|flushslots"
 5) "cluster|slaves"
 6) "cluster|addslotsrange"
 7) "cluster|setslot"
 8) "cluster|set-config-epoch"
 9) "cluster|delslots"
10) "cluster|bumpepoch"
11) "cluster|replicate"
12) "cluster|delslotsrange"
13) "cluster|addslots"
14) "cluster|meet"
15) "cluster|failover"
16) "cluster|count-failure-reports"
17) "cluster|saveconfig"
18) "role"
19) "module|list"
20) "module|loadex"
21) "module|load"
22) "module|unload"
23) "flushdb"
24) "swapdb"
25) "info"
26) "latency|graph"
27) "latency|history"
28) "latency|latest"
29) "latency|doctor"
30) "latency|reset"
31) "latency|histogram"
32) "replicaof"
33) "pfdebug"
34) "monitor"
35) "sort_ro"
36) "bgsave"
37) "restore"
38) "restore-asking"
39) "save"
40) "lastsave"
41) "replconf"
42) "failover"
43) "pfselftest"
44) "bgrewriteaof"
45) "acl|users"
46) "acl|list"
47) "acl|setuser"
48) "acl|log"
49) "acl|getuser"
50) "acl|save"
51) "acl|dryrun"
52) "acl|deluser"
53) "acl|load"
54) "flushall"
55) "shutdown"
56) "slaveof"
57) "slowlog|len"
58) "slowlog|reset"
59) "slowlog|get"
60) "client|kill"
61) "client|no-evict"
62) "client|pause"
63) "client|unblock"
64) "client|list"
65) "client|unpause"
66) "keys"
67) "migrate"
68) "sync"
69) "debug"
70) "psync"
71) "sort"
72) "config|resetstat"
73) "config|rewrite"
74) "config|get"
75) "config|set"

验证危险命令

登录admin账号后执行危险命令

bash 复制代码

127.0.0.1:6379> config get save
(error) NOPERM User admin has no permissions to run the 'config|get' command

更新

更新账号或密码

编辑 users.acl

bash 复制代码

user default off #993bdce878f6b476fc4f5c1403301067ec626e61e8f7229a871ea049f8ad90e1 ~* &* +@all
user admin on #daf9b6d3b2a62dceadf6e76f9be380d464cca3323bb95063f4d6f9cb3696f02b ~* &* +@all -@dangerous

重新加载ACL

bash 复制代码

# 查看命令
# ACL LIST

ACL LOAD