Clarifications on the Incapsula Redis security report • Hacker News Board

Re: Clarifications on the Incapsula Redis security report

#11

Post by brasetvik » Sun, Jun 03, 2018, 5:00 PM UTC

Kiro wrote: post #8

twic wrote: post #2

Surely the real WTF here is that Redis allows unauthenticated connections over the network at all? I appreciate that it's too late to go back and change this, as it would break existing installations on upgrade, but perhaps it's worth pointing that out for the benefit of future server developers. If you want to make things easy for initial setup, you could allow unauthenticated connections over UNIX domain sockets, a…

I don't want to bother with authentication if it's within my own private network.

And that's why server side request forgery (SSRF) is so dangerous.

Re: Clarifications on the Incapsula Redis security report

#12

Post by twic » Sun, Jun 03, 2018, 10:04 PM UTC

snowwolf wrote: post #4

antirez wrote: post #3

Earlier quoted context omitted.

Hello twic, since version 4 Redis by default does not accept connections that are not originating from localhost. Yet we have still problems! Please read the blog post for the exact details about why sane defaults were not enough.

I think the point the parent is trying to make is why allow options 1-3 (disable protected mode) at all? Why not require only option 4 to accept non localhost connections? Although that doesn’t stop someone setting up an install script with a “default” password that becomes known.

That was my point, yes. And my strange suggestion about having an additional server-generated secret was an attempt to secure even servers with weak passwords.

Re: Clarifications on the Incapsula Redis security report

#13

Post by twic » Sun, Jun 03, 2018, 10:04 PM UTC

antirez wrote: post #3

twic wrote: post #2

Surely the real WTF here is that Redis allows unauthenticated connections over the network at all? I appreciate that it's too late to go back and change this, as it would break existing installations on upgrade, but perhaps it's worth pointing that out for the benefit of future server developers. If you want to make things easy for initial setup, you could allow unauthenticated connections over UNIX domain sockets, a…

Hello twic, since version 4 Redis by default does not accept connections that are not originating from localhost. Yet we have still problems! Please read the blog post for the exact details about why sane defaults were not enough.

I read the blog post; what i learned from it is that because sane default choices aren't enough, you also have to disallow insane explicit choices!

Re: Clarifications on the Incapsula Redis security report

#14

Post by gomox » Sun, Jun 03, 2018, 10:40 PM UTC

antirez wrote: post #9

gomox wrote: post #7

It seemed strange to me that the protected mode text warning gives a long winded explanation on 3 ways to disable protected mode first, and leaves the most desireable (change the bind address or password) option for last with a much more brief and less helpful explanation. I would have done a long detailed explanation on bind addr/password, and a "you can also disable protected mode by looking up how to do it on XXXX…

I agree, thanks for the suggestion.

Thanks to you, for the awesome software!