Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support Redis AUTH command #46

Open
timiblossom opened this issue Nov 9, 2014 · 18 comments · May be fixed by #748
Open

Support Redis AUTH command #46

timiblossom opened this issue Nov 9, 2014 · 18 comments · May be fixed by #748
Labels
enhancement

Comments

@timiblossom
Copy link
Contributor

Suggested by @koenvandesande to port over Redis AUTH cmd support in twemproxy:

twitter/twemproxy@878822b

This patch looks good, but need some time to merge and test.
@charsyam
Copy link
Contributor

@timiblossom redis_auth is merged in twemproxy now.
I checked dynomite. It is somewhat different from twemproxy master.
so I will pull request redis_auth patch for dynomite soon. :) Thanks.

@punkeel
Copy link

punkeel commented Jan 9, 2016

Any news on this ? Looks like it's been dropped. What's the recommended way of ensuring security, then ?

@timiblossom
Copy link
Contributor Author

@punkeel we still wait for a patch from anybody. By the way, this is a very week security. It is better that you still protect both your application and dynomite/redis in a safe network that can't be reached by an outsider.

@mantrala mantrala mentioned this issue Sep 13, 2016
Closed
@shailesh33
Copy link
Contributor

Not fixing this unless a requirement arises again.

@lampmanyao
Copy link
Contributor

lampmanyao commented Jul 20, 2017 •
edited

I've implemented this, but i have one question.

That's two steps:

  1. Dynomite sends auth requirepass to redis.

  2. When dynomite receives auth requirepass from client, it won't forward this message to redis, it just compares the requirepass with the redis_auth in config file, and replies the result to the client.

The question is:
At step 1, dynamite can't receive reply after sending auth requirepass to redis.

@shailesh33 shailesh33 reopened this Jul 20, 2017
@shailesh33
Copy link
Contributor

I think requirepass is a conf directive, Did you change that. Also I am not sure what kind of security you get when you are actually sending the password as plain text on the wire.

@axelfauvel
Copy link

Hello,

Looks like @lampmanyao has implemented the feature but i didn't find anything in documentation regarding it.

Has it been implemented ? If so, i can run some tests and update doc if you want. :)

@lampmanyao
Copy link
Contributor

Hi, @axelfauvel
I've implemented this feature base on v0.5.9, but i did not open a PR for it.

@axelfauvel
Copy link

axelfauvel commented Feb 8, 2018 •
edited

It would be great to have this feature

@lampmanyao
Copy link
Contributor

lampmanyao commented Feb 8, 2018 •
edited

Hi, @axelfauvel
I merge this feature to the dev branch: lampmanyao@769ee05

P.S. I have not test completely yet. I will test this as soon as I can.

@axelfauvel
Copy link

great @lampmanyao thanks !

Please keep me posted :)

@axelfauvel
Copy link

Hello @lampmanyao,

Any news on this one ? :)

@lampmanyao
Copy link
Contributor

Hi @axelfauvel , I'm sorry about. I'm working on my own project (an iOS Personal-VPN) all the spare time. I only did a few tests, but it works for me.

@axelfauvel
Copy link

Hi @lampmanyao : I've tried on my side and it works like a charm !! :)

Could you please do the PR so it can be packaged in a future release ? If you have no time, I can also handle the PR, you tell me.

In advance, thanks

@lampmanyao
Copy link
Contributor

Hi @axelfauvel, It's nothing better than this if you do the PR. I really have no time.

@jieqian
Copy link

jieqian commented Apr 12, 2018

@axelfauvel have you done the PR? Can I pull this feature from master branch?

@axelfauvel axelfauvel mentioned this issue Jun 27, 2018
Open
@balajivenki
Copy link
Contributor

Any update here? Will dynomite support Redis auth?

@axelfauvel
Copy link

The PR is still open here : #576

reimannf added a commit to reimannf/dynomite that referenced this issue Dec 13, 2019
@reimannf
Redis AUTH support
2069c3a 
This commit is based on
orange-cloudfoundry@7aa41a4
from @axelfauvel in Netflix#576 and tries to
close Netflix#46.

Unfortunatelly the initial commit was already so old and the dynomite code base already evolved,
that it was easier to not jump directly on this. Especically as there were some refactorings
requested.

Redis Datastore Authentification
If Dynomite is configured to require a password via config option `requirepass` the following
behaviour will be applied:

1. On Dynomite startup, the server authenticates with the backend itself
   by calling the datastore agnostic function g_datastore_auth.
2. The corresponding Redis response will be handeled in g_is_authenticated.
   Dynomite will exit if authentification to the datatstore was not successful.
3. Each newly created client connection will require authentification.
4. Clients can authentificate itself by issue the AUTH command against dynomite.
5. Dynomite will check the password and simulate an AUTH response.
6. If AUTH was successful, the auth_required flag on the connection is reset and
   the client can process further commands through this connection.
@reimannf reimannf linked a pull request Dec 13, 2019 that will close this issue
Open
anujphadke pushed a commit to anujphadke/dynomite that referenced this issue Sep 18, 2020
@ipapapa
Merge pull request Netflix#46 from Netflix/ardbclean
601cb1f 
cleaning storage utilities
mcouillard pushed a commit to mcouillard/dynomite that referenced this issue Jul 4, 2022
@reimannf @mcouillard
Redis AUTH support
6e06b0f 
This commit is based on
orange-cloudfoundry@7aa41a4
from @axelfauvel in Netflix#576 and tries to
close Netflix#46.

Unfortunatelly the initial commit was already so old and the dynomite code base already evolved,
that it was easier to not jump directly on this. Especically as there were some refactorings
requested.

Redis Datastore Authentification
If Dynomite is configured to require a password via config option `requirepass` the following
behaviour will be applied:

1. On Dynomite startup, the server authenticates with the backend itself
   by calling the datastore agnostic function g_datastore_auth.
2. The corresponding Redis response will be handeled in g_is_authenticated.
   Dynomite will exit if authentification to the datatstore was not successful.
3. Each newly created client connection will require authentification.
4. Clients can authentificate itself by issue the AUTH command against dynomite.
5. Dynomite will check the password and simulate an AUTH response.
6. If AUTH was successful, the auth_required flag on the connection is reset and
   the client can process further commands through this connection.
@WenningQiu WenningQiu mentioned this issue Oct 31, 2022
Closed
WenningQiu pushed a commit to CSGOpenSource/dynomite that referenced this issue Oct 31, 2022
@reimannf @WenningQiu
Redis AUTH support (Applied https://github.com/Netflix/dynomite/commi…
c251d58 
…t/682daa32a80396f9522c390d9ffff277df3bd953.patch by W. Qiu)

This commit is based on
orange-cloudfoundry@7aa41a4
from @axelfauvel in Netflix#576 and tries to
close Netflix#46.

Unfortunatelly the initial commit was already so old and the dynomite code base already evolved,
that it was easier to not jump directly on this. Especically as there were some refactorings
requested.

Redis Datastore Authentification
If Dynomite is configured to require a password via config option `requirepass` the following
behaviour will be applied:

1. On Dynomite startup, the server authenticates with the backend itself
   by calling the datastore agnostic function g_datastore_auth.
2. The corresponding Redis response will be handeled in g_is_authenticated.
   Dynomite will exit if authentification to the datatstore was not successful.
3. Each newly created client connection will require authentification.
4. Clients can authentificate itself by issue the AUTH command against dynomite.
5. Dynomite will check the password and simulate an AUTH response.
6. If AUTH was successful, the auth_required flag on the connection is reset and
   the client can process further commands through this connection.
mcouillard pushed a commit to vtinfo/dynomite that referenced this issue Nov 18, 2022
@reimannf @mcouillard
Redis AUTH support
ac48ba8 
This commit is based on
orange-cloudfoundry@7aa41a4
from @axelfauvel in Netflix#576 and tries to
close Netflix#46.

Unfortunatelly the initial commit was already so old and the dynomite code base already evolved,
that it was easier to not jump directly on this. Especically as there were some refactorings
requested.

Redis Datastore Authentification
If Dynomite is configured to require a password via config option `requirepass` the following
behaviour will be applied:

1. On Dynomite startup, the server authenticates with the backend itself
   by calling the datastore agnostic function g_datastore_auth.
2. The corresponding Redis response will be handeled in g_is_authenticated.
   Dynomite will exit if authentification to the datatstore was not successful.
3. Each newly created client connection will require authentification.
4. Clients can authentificate itself by issue the AUTH command against dynomite.
5. Dynomite will check the password and simulate an AUTH response.
6. If AUTH was successful, the auth_required flag on the connection is reset and
   the client can process further commands through this connection.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Redis AUTH support reimannf/dynomite
9 participants
@charsyam @timiblossom @lampmanyao @punkeel @jieqian @ipapapa @balajivenki @shailesh33 @axelfauvel