Skip to content

Commit 64d334f

Browse files
wangyeleiwangyelei
authored
chore: encrypt redis default password (#2460)
1 parent d0879b7 commit 64d334f

File tree

5 files changed

+28
-14
lines changed

5 files changed

+28
-14
lines changed

‎addons/redis/redis-cluster-scripts/redis-cluster-server-start.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -567,11 +567,13 @@ build_redis_default_accounts() {
567567
if ! is_empty "$REDIS_REPL_PASSWORD"; then
568568
echo "masteruser $REDIS_REPL_USER" >> $redis_real_conf
569569
echo "masterauth $REDIS_REPL_PASSWORD" >> $redis_real_conf
570-
echo "user $REDIS_REPL_USER on +psync +replconf +ping >$REDIS_REPL_PASSWORD" >> $redis_acl_file
570+
redis_repl_password_sha256=$(echo -n "$REDIS_REPL_PASSWORD" | sha256sum | cut -d' ' -f1)
571+
echo "user $REDIS_REPL_USER on +psync +replconf +ping #$redis_repl_password_sha256" >> $redis_acl_file
571572
fi
572573
if ! is_empty "$REDIS_DEFAULT_PASSWORD"; then
573574
echo "protected-mode yes" >> $redis_real_conf
574-
echo "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all " >> $redis_acl_file
575+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
576+
echo "user default on #$redis_password_sha256 ~* &* +@all " >> $redis_acl_file
575577
else
576578
echo "protected-mode no" >> $redis_real_conf
577579
fi

‎addons/redis/redis-cluster-scripts/redis-cluster6-server-start.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -522,11 +522,13 @@ build_redis_default_accounts() {
522522
if ! is_empty "$REDIS_REPL_PASSWORD"; then
523523
echo "masteruser $REDIS_REPL_USER" >> $redis_real_conf
524524
echo "masterauth $REDIS_REPL_PASSWORD" >> $redis_real_conf
525-
echo "user $REDIS_REPL_USER on +psync +replconf +ping >$REDIS_REPL_PASSWORD" >> $redis_acl_file
525+
redis_repl_password_sha256=$(echo -n "$REDIS_REPL_PASSWORD" | sha256sum | cut -d' ' -f1)
526+
echo "user $REDIS_REPL_USER on +psync +replconf +ping #$redis_repl_password_sha256" >> $redis_acl_file
526527
fi
527528
if ! is_empty "$REDIS_DEFAULT_PASSWORD"; then
528529
echo "protected-mode yes" >> $redis_real_conf
529-
echo "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all " >> $redis_acl_file
530+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
531+
echo "user default on #$redis_password_sha256 ~* &* +@all " >> $redis_acl_file
530532
else
531533
echo "protected-mode no" >> $redis_real_conf
532534
fi

‎addons/redis/scripts-ut-spec/redis_cluster_server_start_spec.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,10 @@ Describe "Redis Cluster Server Start Bash Script Tests"
6868
The contents of file "$redis_real_conf" should include "masterauth $REDIS_REPL_PASSWORD"
6969
The contents of file "$redis_real_conf" should include "protected-mode yes"
7070
The contents of file "$redis_real_conf" should include "aclfile /data/users.acl"
71-
The contents of file "$redis_acl_file" should include "user $REDIS_REPL_USER on +psync +replconf +ping >$REDIS_REPL_PASSWORD"
72-
The contents of file "$redis_acl_file" should include "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all"
71+
redis_repl_sha256=$(echo -n "$REDIS_REPL_PASSWORD" | sha256sum | cut -d' ' -f1)
72+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
73+
The contents of file "$redis_acl_file" should include "user $REDIS_REPL_USER on +psync +replconf +ping #$redis_repl_sha256"
74+
The contents of file "$redis_acl_file" should include "user default on #$redis_password_sha256 ~* &* +@all"
7375
End
7476
End
7577

@@ -92,7 +94,8 @@ Describe "Redis Cluster Server Start Bash Script Tests"
9294
The stdout should include "build redis default accounts succeeded!"
9395
The contents of file "$redis_real_conf" should include "protected-mode yes"
9496
The contents of file "$redis_real_conf" should include "aclfile /data/users.acl"
95-
The contents of file "$redis_acl_file" should include "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all"
97+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
98+
The contents of file "$redis_acl_file" should include "user default on #$redis_password_sha256 ~* &* +@all"
9699
End
97100
End
98101

‎addons/redis/scripts-ut-spec/redis_start_spec.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,9 +89,12 @@ Describe "Redis Start Bash Script Tests"
8989
The contents of file "$redis_real_conf" should include "masterauth $REDIS_REPL_PASSWORD"
9090
The contents of file "$redis_real_conf" should include "protected-mode yes"
9191
The contents of file "$redis_real_conf" should include "aclfile /data/users.acl"
92-
The contents of file "$redis_acl_file" should include "user $REDIS_REPL_USER on +psync +replconf +ping >$REDIS_REPL_PASSWORD"
93-
The contents of file "$redis_acl_file" should include "user $REDIS_SENTINEL_USER on allchannels +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|kill >$REDIS_SENTINEL_PASSWORD"
94-
The contents of file "$redis_acl_file" should include "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all"
92+
redis_repl_sha256=$(echo -n "$REDIS_REPL_PASSWORD" | sha256sum | cut -d' ' -f1)
93+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
94+
redis_sentinel_password_sha256=$(echo -n "$REDIS_SENTINEL_PASSWORD" | sha256sum | cut -d' ' -f1)
95+
The contents of file "$redis_acl_file" should include "user $REDIS_REPL_USER on +psync +replconf +ping #$redis_repl_sha256"
96+
The contents of file "$redis_acl_file" should include "user $REDIS_SENTINEL_USER on allchannels +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|kill #$redis_sentinel_password_sha256"
97+
The contents of file "$redis_acl_file" should include "user default on #$redis_password_sha256 ~* &* +@all"
9598
End
9699
End
97100

@@ -114,7 +117,8 @@ Describe "Redis Start Bash Script Tests"
114117
The stdout should include "build default accounts succeeded!"
115118
The contents of file "$redis_real_conf" should include "protected-mode yes"
116119
The contents of file "$redis_real_conf" should include "aclfile /data/users.acl"
117-
The contents of file "$redis_acl_file" should include "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all"
120+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
121+
The contents of file "$redis_acl_file" should include "user default on #$redis_password_sha256 ~* &* +@all"
118122
End
119123
End
120124

‎addons/redis/scripts/redis-start.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,17 @@ build_redis_default_accounts() {
6060
if ! is_empty "$REDIS_REPL_PASSWORD"; then
6161
echo "masteruser $REDIS_REPL_USER" >> $redis_real_conf
6262
echo "masterauth $REDIS_REPL_PASSWORD" >> $redis_real_conf
63-
echo "user $REDIS_REPL_USER on +psync +replconf +ping >$REDIS_REPL_PASSWORD" >> $redis_acl_file
63+
redis_repl_password_sha256=$(echo -n "$REDIS_REPL_PASSWORD" | sha256sum | cut -d' ' -f1)
64+
echo "user $REDIS_REPL_USER on +psync +replconf +ping #$redis_repl_password_sha256" >> $redis_acl_file
6465
fi
6566
if ! is_empty "$REDIS_SENTINEL_PASSWORD"; then
66-
echo "user $REDIS_SENTINEL_USER on allchannels +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|kill >$REDIS_SENTINEL_PASSWORD" >> $redis_acl_file
67+
redis_sentinel_password_sha256=$(echo -n "$REDIS_SENTINEL_PASSWORD" | sha256sum | cut -d' ' -f1)
68+
echo "user $REDIS_SENTINEL_USER on allchannels +multi +slaveof +ping +exec +subscribe +config|rewrite +role +publish +info +client|setname +client|kill +script|kill #$redis_sentinel_password_sha256" >> $redis_acl_file
6769
fi
6870
if ! is_empty "$REDIS_DEFAULT_PASSWORD"; then
6971
echo "protected-mode yes" >> $redis_real_conf
70-
echo "user default on >$REDIS_DEFAULT_PASSWORD ~* &* +@all " >> $redis_acl_file
72+
redis_password_sha256=$(echo -n "$REDIS_DEFAULT_PASSWORD" | sha256sum | cut -d' ' -f1)
73+
echo "user default on #$redis_password_sha256 ~* &* +@all " >> $redis_acl_file
7174
else
7275
echo "protected-mode no" >> $redis_real_conf
7376
fi

0 commit comments

Comments
 (0)