Securing Redis with ACLs?

evilpanda · June 11, 2024, 6:21am

Is it possible to add a username and/or key prefix details to the Redis details within the env file?

Would be useful if sharing a single instance of Redis across multiple applications, on multi-tenant/shared hosting etc.

hillel · June 11, 2024, 6:50am

Hi,

Can you please help us understand how you’re using the app?

You may want to review the app’s license:

evilpanda · June 11, 2024, 8:22am

Thanks, from my understanding of that I’m not running a SaaS so should be within the license terms?

I have the app on a server that also has 2 of my businesses promotional sites. I am currently using a single instance of Redis on both IN and these sites, but would like to restrict access to Redis by using ACLs to have better isolation between apps. Install is self hosted zip with white-label license.

IN has password, but wasn’t sure if prefix / username options are available?

hillel · June 11, 2024, 8:38am

@david can you please advise?

david · June 12, 2024, 5:00am

i’d look into the redis authentication inthe laravel docs

evilpanda · June 12, 2024, 6:11am

Thanks for the help so far.

According to those docs using REDIS_USERNAME should work, but when I add this to the IN .env file I get the below error in laravel.log:

[previous exception] [object] (Predis\\Connection\\ConnectionException(code: 0): `AUTH` failed: WRONGPASS invalid username-password pair [tcp://127.0.0.1:6379] at /home/myapp/webapps/myappagain/vendor/predis/predis/src/Connection/AbstractConnection.php:144)

Add can confirm the user/password is correct, tested with redis-cli, no special characters used.

hillel · June 12, 2024, 6:21pm

I’m not sure all Redit params are available in the .env file, instead you can update the values directly in the queue config file.

Note: these values would be overwritten when updating the app.

github.com

invoiceninja/invoiceninja/blob/v5-stable/config/queue.php#L65


      
                  'driver' => 'sqs',
                  'key' => env('AWS_ACCESS_KEY_ID'),
                  'secret' => env('AWS_SECRET_ACCESS_KEY'),
                  'prefix' => env('SQS_PREFIX', 'https://sqs.us-east-1.amazonaws.com/your-account-id'),
                  'queue' => env('SQS_QUEUE', 'default'),
                  'suffix' => env('SQS_SUFFIX'),
                  'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
                  'after_commit' => false,
              ],
          
              'redis' => [
                  'driver' => 'redis',
                  'connection' => env('REDIS_QUEUE_CONNECTION', 'default'),
                  'queue' => env('REDIS_QUEUE', 'default'),
                  'retry_after' => 90000000,
                  'block_for' => null,
                  'after_commit' => false,
              ],
          
          ],

evilpanda · June 12, 2024, 10:06pm

Thanks, no chance of those params being supported by the .env file in future? It would be an easy security enhancement for users after all

hillel · June 13, 2024, 5:05am

Sure, you’d need to either create an issue on GitHub to request or submit a pull request.