Redis 保护模式

Redis从3.2开始加强安全管理，如果redis没有设置密码，那么redis客户端只能从本地进行访问，如果是从其他机器连接过来访问的，就会报错误。

 

Protected mode

Unfortunately many users fail to protect Redis instances from being accessed from external networks. Many instances are simply left exposed on the internet with public IPs. For this reasons since version 3.2.0, when Redis is executed with the default configuration (binding all the interfaces) and without any password in order to access it, it enters a special mode called protected mode. In this mode Redis only replies to queries from the loopback interfaces, and reply to other clients connecting from other addresses with an error, explaining what is happening and how to configure Redis properly.

We expect protected mode to seriously decrease the security issues caused by unprotected Redis instances executed without proper administration, however the system administrator can still ignore the error given by Redis and just disable protected mode or manually bind all the interfaces.

 

下面是在实际运行过程中发现的报错：

 

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'redisAccessor' defined in class path resource [dmz-context.xml]: Invocation of init method failed; nested exception is redis.clients.jedis.exceptions.JedisDataException: DENIED Redis is running in protected mode because protected mode is enabled, no bind address was specified, no authentication password is requested to clients. In this mode connections are only accepted from the loopback interface.

 

If you want to connect from external computers to Redis you may adopt one of the following solutions:

1) Just disable protected mode sending the command 'CONFIG SET protected-mode no' from the loopback interface by connecting to Redis from the same host the server is running, however MAKE SURE Redis is not publicly accessible from internet if you do so. Use CONFIG REWRITE to make this change permanent.

2) Alternatively you can just disable the protected mode by editing the Redis configuration file, and setting the protected mode option to 'no', and then restarting the server.

3) If you started the server manually just for testing, restart it with the '--protected-mode no' option.

4) Setup a bind address or an authentication password.

 

NOTE: You only need to do one of the above things in order for the server to start accepting connections from the outside.

 

解决方案是设置参数protected-mode no，这个参数可以动态设置，或者为redis设置密码。

 

redis-cli -p 6500 config set protected-mode no

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/25105315/viewspace-2124220/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/25105315/viewspace-2124220/