1. 19 Dec, 2021 1 commit
    • YaacovHazan's avatar
      Protected configs and sensitive commands (#9920) · ae2f5b7b
      YaacovHazan authored
      Block sensitive configs and commands by default.
      
      * `enable-protected-configs` - block modification of configs with the new `PROTECTED_CONFIG` flag.
         Currently we add this flag to `dbfilename`, and `dir` configs,
         all of which are non-mutable configs that can set a file redis will write to.
      * `enable-debug-command` - block the `DEBUG` command
      * `enable-module-command` - block the `MODULE` command
      
      These have a default value set to `no`, so that these features are not
      exposed by default to client connections, and can only be set by modifying the config file.
      
      Users can change each of these to either `yes` (allow all access), or `local` (allow access from
      local TCP connections and unix domain connections)
      
      Note that this is a **breaking change** (specifically the part about MODULE command being disabled by default).
      I.e. we don't consider DEBUG command being blocked as an issue (people shouldn't have been using it),
      and the few configs we protected are unlikely to have been set at runtime anyway.
      On the other hand, it's likely to assume some users who use modules, load them from the config file anyway.
      Note that's the whole point of this PR, for redis to be more secure by default and reduce the attack surface on
      innocent users, so secure defaults will necessarily mean a breaking change.
      ae2f5b7b
  2. 19 Dec, 2016 1 commit
  3. 10 Jul, 2014 1 commit
  4. 12 Jun, 2013 1 commit
  5. 15 May, 2013 1 commit
  6. 04 Apr, 2013 1 commit
  7. 05 Feb, 2013 1 commit
  8. 28 Jan, 2013 3 commits
  9. 29 Mar, 2012 1 commit
  10. 10 Mar, 2012 1 commit
  11. 25 Jun, 2011 1 commit
  12. 09 Jan, 2011 1 commit
  13. 03 Jan, 2011 1 commit
  14. 02 Jan, 2011 1 commit
  15. 20 May, 2010 1 commit
  16. 14 May, 2010 2 commits
  17. 10 May, 2010 1 commit
  18. 07 May, 2010 2 commits
  19. 06 May, 2010 1 commit
  20. 22 Apr, 2010 1 commit
  21. 15 Apr, 2010 1 commit
  22. 09 Apr, 2010 1 commit
  23. 02 Apr, 2010 1 commit
  24. 20 Mar, 2010 1 commit
  25. 07 Mar, 2010 1 commit
  26. 27 Feb, 2010 1 commit
  27. 10 Feb, 2010 1 commit
  28. 06 Feb, 2010 1 commit
  29. 15 Jan, 2010 1 commit
  30. 12 Jan, 2010 1 commit
  31. 09 Jan, 2010 1 commit
  32. 07 Jan, 2010 3 commits
  33. 06 Jan, 2010 2 commits