1

I'm new to Magento2. I'm using a dedicated server with 24core and 32GB ram with 1Gb/s net speed for my eCommerce website. As it is a very powerful server I'm running the databases locally on the server. Now my question is I've installed Elastic Search and Redis cache locally in the server and I've enabled the file wall to enable only port 80 and 443 so do I now need to set the password for Redis?

For elastic search I already know:

I already know that if we host elastic search in the local machine we just need to bind the network host to localhost and disable the outbound port. No need to set the ElasticSearch password. But if I host elastic Search outside, I need to allow the port and set the password.

So, I'm just wanting to know about Redis :)

2 Answers 2

1

Question: So, I'm just wanting to know about Redis

Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket.

So it is not mandatory to set a password if we didn't expose Redis to the internet.

The goal of the authentication layer is to optionally provide a layer of redundancy. If firewalling or any other system implemented to protect Redis from external attackers fail, an external client will still not be able to access the Redis instance without knowledge of the authentication password.

As per the Redis official document and It is up to you to enable authentication. We can enable authentication if we think firewalling or any other system implemented to protect Redis from external attackers fail.

Reference: https://redis.io/topics/security

0

There is no specific requirement that enforces the need of having a password set in order to communicate with the Redis instance.

2
  • I'm talking about security if I don't put Redis's password is there is a chance for my server to get compromised by a hacker?
    – udoyhasan
    Jun 22, 2021 at 14:23
  • well, there are many other things that need to be in check, many security levels. not setting a pass for your connection to redis might not be your biggest issue. i recommend you read github.com/talesh/magento-security-checklist
    – Diana
    Jun 22, 2021 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.