2

I'm trying to secure the Node Redis IPC server to use a private/public key. I've followed this tutorial which uses stunnel which wraps the tunnel used by Redis under a SSL layer.

The example is not for Node, but it does secure the connection, and I only can connect to the server if I include the certification in my config file, otherwise the connection is reseted.

However, I cannot replicate this with NodeJS. On my server computer, I have:

var redis = require('redis'); 
var client = redis.createClient();

client.auth('myPassword');
client.publish('instances', 'start');

And my on my client computer I have:

var redis = require('redis');
var client = redis.createClient();

client.auth('myPassword');
client.subscribe('instances');
client.on('message', function (channel, message) {
  console.log("Got message " + message + " from channel " + channel);
})

But, the two devices communicate whether or not I include the certification in my stunnel config file. How can I secure this connection up?

Cheers

Kousha
  • 32,871
  • 51
  • 172
  • 296
  • Probably you exposed the non-secure port on your server and connected to that with the client. You have to disable connections to your non-secure port on the server. – Balázs Németh Mar 23 '16 at 09:13

2 Answers2

12

You can do this by passing in the tls configuration when creating the client like so 

var redis = require("redis");

var client = redis.createClient(6380,'location.of.server', {auth_pass: 'password', tls: {servername: 'location.of.server'}});
ScottGuymer
  • 1,885
  • 1
  • 17
  • 22
-5

I have also searched for this . But redis doesn't need any ssl since in runs only on verified private networks. The only way to provide security using stunnel. Since we can enable password by using AUTH command. In redis they have provided a password generator which is named as GPG key. Which generated a 2048 length key which will provide security. I think my answer is relevant.

Akilesh Reddzz
  • 36
  • 1
  • While "not needing ssl" may work for you in your case, it is not a broad enough assumption. There are some industries which are regulated (medical with HIPAA for example) which require data to be encrypted in transit and at rest, therefore requiring TLS. The question wasn't "should I secure redis" it was a question of how. – ehftwelve Aug 29 '18 at 15:47