• antirez's avatar
    New security feature: Redis protected mode. · edd4d555
    antirez authored
    An exposed Redis instance on the internet can be cause of serious
    issues. Since Redis, by default, binds to all the interfaces, it is easy
    to forget an instance without any protection layer, for error.
    
    Protected mode try to address this feature in a soft way, providing a
    layer of protection, but giving clues to Redis users about why the
    server is not accepting connections.
    
    When protected mode is enabeld (the default), and if there are no
    minumum hints about the fact the server is properly configured (no
    "bind" directive is used in order to restrict the server to certain
    interfaces, nor a password is set), clients connecting from external
    intefaces are refused with an error explaining what to do in order to
    fix the issue.
    
    Clients connecting from the IPv4 and IPv6 lookback interfaces are still
    accepted normally, similarly Unix domain socket connections are not
    restricted in any way.
    edd4d555
server.c 159 KB