Phase 7: Security, Fine-Grained ACLs & Network Hardening¶

Audience: Principal Distributed Systems Security Engineer & Infrastructure Architect
Source References: src/acl.c, src/tls.c, src/config.c

1. The Redis ACL Engine (Redis 6.0+)¶

Prior to Redis 6.0, Redis security relied on a single global password (requirepass). Any authenticated client had unrestricted root access to execute destructive commands (FLUSHALL, CONFIG SET, SHUTDOWN).

Redis 6.0 introduced a fine-grained Access Control List (ACL) engine embedded directly into the command dispatch pipeline.

┌────────────────────────────────────────────────────────┐
│                   ACL Check Pipeline                   │
└───────────────────────────┬────────────────────────────┘
                            │
                            ▼
              [ Client issues: GET cached:user:1 ]
                            │
                            ▼
        [ Step 1: User Authentication & State Check ]
        - Is user active (+on)?
        - Does password match SHA256 digest?
                            │
                            ▼
        [ Step 2: Command Category Bitmask Validation ]
        - Does user have permission for 'GET'?
        - Checked against cmd->flags and user->allowed_commands
                            │
                            ▼
        [ Step 3: Key Pattern Matching (~pattern) ]
        - Does 'cached:user:1' match allowed key prefixes?
        - Regex/glob evaluation
                            │
                            ▼
        [ Step 4: Execution or ACL Failure Log Entry ]
        - If permitted: processCommand()
        - If denied: Return -NOPERM and increment ACL log

1.1 Command Categories & The Dangerous Filter¶

Commands are tagged with categorical bitmasks (src/server.c): - @read: Read-only queries (GET, HGET, LRANGE) - @write: Mutating operations (SET, HSET, DEL) - @admin: Instance management (CONFIG, SHUTDOWN, DEBUG) - @dangerous: High CPU / destructive commands (FLUSHALL, KEYS, SORT, EVAL) - @connection: Session management (AUTH, PING, QUIT)

1.2 Defining Enterprise ACL Users¶

# Create a read-only analytics worker restricted to reporting keys
ACL SETUSER analytics on >ComplexPass#892 +@read -@dangerous ~report:* ~metrics:*

# Create a service worker allowed to read/write cache but blocked from admin commands
ACL SETUSER app_service on >AppSecret!2024 +@all -@admin -@dangerous ~cache:* resetchannels &events:*

1.3 The ACL Log for Security Forensics¶

When an unauthorized command is blocked:

ACL LOG 5

Returns: - Violating client IP and port. - Authenticated username. - Full raw command line executed. - Precise failure reason (COMMAND, KEY, or CHANNEL).

2. TLS/SSL Encryption Architecture¶

Redis natively supports TLS v1.2 and v1.3 using OpenSSL.

2.1 The Throughput Tax of TLS¶

Because Redis operates at memory speeds (\(\approx 100,000 \text{ ops/sec}\) per core), encrypting every payload with AES-GCM or ChaCha20 imposes a measurable CPU tax: - Throughput typically decreases by 20% to 35%. - Latency increases by \(\approx 0.1-0.3 \text{ ms}\) due to cryptographic handshakes and record layer framing.

2.2 Mutual TLS (mTLS) Hardening Configuration¶

# TLS Listening Port (Disable plaintext port)
port 0
tls-port 6379

# Certificate Authority & Keys
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt

# Enforce Client Certificate Authentication (mTLS)
tls-auth-clients yes

# TLS Session Caching (Crucial for high connection churn)
tls-session-caching yes
tls-session-cache-size 20000
tls-session-cache-timeout 300

# Protocols and Ciphers
tls-protocols "TLSv1.3"
tls-ciphersuites "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
tls-prefer-server-ciphers yes

# Enable TLS across Cluster Bus and Replication Links
tls-replication yes
tls-cluster yes

3. Defensive Host & Kernel Hardening¶

3.1 Renaming Destructive Legacy Commands¶

For environments running without ACLs or legacy clients:

rename-command FLUSHALL ""
rename-command FLUSHDB  ""
rename-command CONFIG   "SYS_CONFIG_OBSCURED_98234"
rename-command KEYS     ""
rename-command SHUTDOWN "SYS_SHUTDOWN_OBSCURED_4812"

3.2 Linux Systemd & Sandbox Hardening¶

Preventing a compromised Redis daemon from accessing the host file system:

# /etc/systemd/system/redis.service.d/hardening.conf
[Service]
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateTmp=yes
PrivateDevices=yes
CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
NoNewPrivileges=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX