Using Redis in an untrusted environment (multiple users)

Question

I've been doing some research into Redis and the security model. My issue is that I will have numerous users using Redis as a caching layer, each for their own applications. I'm in a shared environment in which I cannot split users into their own VPSes or instances.

Each user IS however chrooted to their own home directories and spawn their own processes. Would it be possible to run Redis-Server under each user account so they have their own instance and if so, how?

Redis has no such functionality. It was [not designed for it](http://redis.io/topics/security). Each user would need their own Redis instance, _and_ some way to isolate them from other users. — Michael Hampton, Feb 15 '16 at 22:13
Damn, at the least I was looking per database authentication.. — zorrobyte, Feb 15 '16 at 22:14

score 1 · Answer 1 · answered Apr 18 '20 at 08:50

1

Redis 6 is currently in beta and will probably be released soon. It provides support for multiple accounts and access control lists, so you can share one Redis instances with many users.

The ACL documentation is available at https://redis.io/topics/acl

answered Apr 18 '20 at 08:50

JeLuF

11
1

Redis 6 is released (ACL is onboard). – victorm1710 Feb 19 '21 at 10:08

score 0 · Answer 2 · answered May 19 '21 at 15:03

0

you can user multiple 'prefix' in connection configure

let client = redis.createClient({
          host,
          port,
          user,
          password,
          prefix,
});

source : enter link description here

answered May 19 '21 at 15:03

Mahdad

101

score 0 · Answer 3 · answered Feb 15 '16 at 22:28

Why not just run multiple instances of Redis on the same server, each using a separate config file with a separate:

Password
PID file
Port
Log File
Directory

An example of such can be found here:

http://chrislaskey.com/blog/342/running-multiple-redis-instances-on-the-same-server/

Using Redis in an untrusted environment (multiple users)

3 Answers3