Redis默认安装配置文件可能存在未授权访问风险

本人前几天安装了一台测试机器做Redis服务, redis.conf是默认的。发现系统的ssh key目录有一个是被注入的公钥,导致系统被入侵。其实官方已经有明显提示风险了。怪自己没仔细看文档,大体是这样的。

一、漏洞描述和危害 

Redis因配置不当可以未授权访问,被攻击者恶意利用。
攻击者无需认证访问到内部数据,可能导致敏感信息泄露,黑客也可以恶意执行flushall来清空所有数据。

攻击者可通过EVAL执行lua代码,或通过数据备份功能往磁盘写入后门文件,如果Redis以root身份运行,黑客可以给root账户写入SSH公钥文件,直接通过SSH登录受害服务器。

二、已确认被成功利用的软件及系统  

对公网开放,且未启用认证的redis服务器。

三、建议修复方案

1、指定redis服务使用的网卡 (需要重启redis才能生效)
在 redis.conf 文件中找到 “# bind 127.0.0.1” ,把前面的#号去掉,然后保存。注:修改后只有本机才能访问Redis。

2、设置访问密码 (需要重启redis才能生效)
在 redis.conf 中找到“requirepass”字段,在后面填上你需要的密码,Redis客户端也需要使用此密码来访问Redis服务。

3、修改Redis服务运行账号
请以较低权限账号运行Redis服务,且禁用该账号的登录权限。可以限制攻击者往磁盘写入文件,但是Redis数据还是能被黑客访问到,或者被黑客恶意删除。

4、设置防火墙策略

如果正常业务中Redis服务需要被其他服务器来访问,可以设置iptables策略仅允许指定的IP来访问Redis服务。

 

 

1,739 Comments

  1. Wow!, this was a top quality post. In explanation I’d like to write like this as well – taking time and real effort to make a nice article… but what can I say… I keep putting it off and never seem to get something done

  2. The author covered some curious points here. I came across this by using Yahoo and I must confess that I am currently subscribed for your blog, it is quite great

  3. e. Lead something that would benefit readers. Most likely you are able to help many others reap the benefits of your activities. Certainly it is easy to inspire visitors in certain way. Do not be scared to expose a little something about your self that lets visitors know alot more about who you are. It is not nearly running a blog for organization. Blogging is intended to become like pleasurable conversation.

  4. There are undoubtedly a lot of specifics like that to think about. That is a good point to raise up. I supply the thoughts previously mentioned as normal inspiration however clearly you can find questions like the one anyone bring up the spot that the most important thing will be working in honest good faith. My spouse and i don?testosterone levels know if guidelines have emerged around such thinggs as that, nonetheless I am sure that a job will be clearly known as a fair game. Both kids feel the affect of just a moment’s delight, for the rest of their particular lives.

  5. We still cannot quite assume that I made it worse often be kind of staring at the important points seen on your blog post. Our grandkids and i also are sincerely thankful with regards to your generosity plus giving me possibility pursue our chosen profession path. Document information and facts I became of the web-site.

  6. Oh my goodness! an excellent post dude. Many thanks However We are experiencing problem with ur rss . Don’t know why Not able to sign up to it. Could there be anybody getting identical rss dilemma? Anyone who knows kindly respond. Thnkx

  7. This website can be a walk-by way of for all of the data you needed about this and didn’t know who to ask. Glimpse here, and also you’ll definitely uncover it.

  8. Situated at a corner on Mohammed Ali Street, this location has two doorways. When you get within and go up, there appear to be rooms soon after rooms just after rooms. It is all  perplexing, but just let the waiters guide you. As soon as settled, get some time to explore the menu. There are excellent “Tawa-taka-tak” goods and “Raan” dishes. You can consider a crack at paya soup, seekh kebabs, chicken tandoori and chicken afghani. Seekh kebabs are superior. The tandoori rotis are superb. They also have spots where by they serve other stuff like snacks, faloodas, kulfis etc.

  9. Woah! I’m really digging the template/theme of this website. It’s simple, yet effective. A lot of times it’s challenging to get that “perfect balance” between user friendliness and appearance. I must say that you’ve done a great job with this. Additionally, the blog loads extremely fast for me on Internet explorer. Outstanding Blog!

  10. I am usually to blogging i genuinely appreciate your content. Your content has really peaks my interest. I will bookmark your site and maintain checking for new info.

  11. Youre so cool! I dont suppose Ive read anything like this before. So nice to search out any individual with some original thoughts on this subject. realy thank you for starting this up. this website is one thing that’s wanted on the web, somebody with a bit of originality. useful job for bringing something new to the internet!

  12. I would like to express thanks to you just for rescuing me from such a circumstance. Because of exploring through the online world and meeting recommendations which were not helpful, I figured my life was done. Being alive devoid of the strategies to the issues you have solved all through the write-up is a serious case, and ones which might have adversely affected my career if I hadn’t discovered your web blog. Your primary ability and kindness in handling every aspect was very useful. I am not sure what I would’ve done if I had not come upon such a step like this. I am able to at this time look forward to my future. Thank you so much for this skilled and amazing help. I won’t hesitate to recommend your web sites to any person who desires support about this subject matter.

  13. The best way to reduce the problem is through smart preventive measures. viagra overnight shipping benefits of viagra for men free sample viagra [url=http://viagraformenvfa.com/]viagra for men[/url] Learning about all of these factors and knowing what to do when blood glucose levels are above or below target can take quite a bit of time. OK’

  14. In fact, they’re not even allowed to enter a rental home to do an inspection without the owner’s permission. viagra by mail viagra for women for sale viagra alternative [url=http://viagraforsalebrc.com/]buy viagra[/url] Disposable Diapers: A Quantitative Comparison Cold Hard Truth Becoming a stronger person Add some giggles to your gifts View the discussion thread. OK’

  15. Pingback: Google
  16. Pingback: jelly chocolate dream
  17. Pingback: Laverdaddesnuda.com
  18. Pingback: tubidy
  19. Pingback: deep throat simulator
  20. Pingback: masturbation sleeve
  21. Pingback: powerfull vibrators
  22. Pingback: bullet sex toy
  23. Pingback: waterproof vibrator
  24. Class demands will differ from institution to school, cheap medicine online so you will certainly have to do your research. In fact there could be many various other demands for different Pharm.D. programs, so I have provide a chart that details called for programs at every drug store institution. For particular training course numbers equivalencies, you will have to perform your personal search on the Internet or speak to the admission offices at each school of pharmacy.
    buy cialis in canada online [url=http://canadianpharmacyextra.com/]online pharmacy uk[/url]

  25. Pingback: سرور مجازی
  26. Try to find the on the internet pharmacy’s certificate number, telephone number drugs canada as well as physical address on the site. Also search for the regulatory body that takes care of its procedures. Many regulatory bodies have a list of signed up pharmacies on their site. Phone the pharmacy and check whether a pharmacist is offered to chat with you and take your order. [url=http://bingpharmacy2018.com/]discount cialis canada[/url]
    viagra canada online pharmacy

  27. Pingback: Love
  28. Pingback: lesbian vibrator
  29. Pingback: rabbit vibe
  30. Pingback: g spot massage
  31. Pingback: adult games review
  32. Pingback: adam and eve products
  33. Pingback: table of elements
  34. Pingback: netflix free
  35. Pingback: iPhone Cable
  36. Pingback: iPhone cable charger
  37. Pingback: Lenovo
  38. Are you sick and tired of being bored? You’ll never have a dull moment if you visit http://camgirl.pw It’s by far the most exciting site on the internet. There, you’ll be able to talk to all kinds of hot babes. Don’t be surprised if everyone at work asks why you’re so happy. You don’t need to tell them that you visit this site each and every day. It’ll be your little secret.

  39. Some online drug stores will market real drugs yet will viagra coupons swipe your details to make money as well as market it as newsletter that would lead to a chaotic mail box. You can likewise deal with a bank card scams due to the fact that on-line pharmacies become privy to such details after the monetary transaction. For this reason, you have to make certain that the Canadian pharmacy online has an effective information security plan in position.
    side effects of viagra [url=http://toppharmacyusa.com/]viagra sales[/url]

  40. Pingback: oral sex tips
  41. Search for the on the internet drug store’s permit number, telephone number canadian pharm and also physical address on the web site. Additionally seek the regulatory body that cares for its operations. A lot of regulatory bodies have a checklist of signed up drug stores on their internet site. Call up the drug store and check whether a pharmacist is available to chat with you and also take your order. [url=http://bingpharmacyrx.com/]canadian drugs viagra[/url]
    buy canadian pharmacy

  42. Pingback: app download for pc
  43. Pingback: satisfyer pro deluxe
  44. Pingback: games pc download
  45. Pingback: MILF
  46. Pingback: segodnya praznik
  47. Pingback: small vibrator
  48. Pingback: tantric masseur paris
  49. Pharmacy4you [url=http://cialiorder.com]cialis 5 mg best price usa[/url] Buy Benicar Without A Prescription Resultados De Propecia buy accutane forum

  50. Pingback: boston amazon
  51. Pingback: Pc mac repair
  52. Pingback: سئو وب سایت
  53. Class demands will certainly differ from college to institution, medicine prescription so you will certainly should do your study. As a matter of fact there may be numerous various other requirements for different Pharm.D. programs, so I have provide a chart that lists required programs at every drug store school. For specific program numbers equivalencies, you will should perform your own search on the web or speak to the admission workplaces at each college of pharmacy.
    canadian pharmacist [url=http://canadianpharmacyextra.com/]cialis from online pharmacy[/url]

  54. natural forms of viagra cialis pills
    [url=http://buywcialisnrx.com/#]cheap cialis[/url]
    find cialis generic
    [url=http://buywcialisnrx.com/#”>cialis online

  55. price cialis 20mg nurofen plus
    [url=http://buywcialisnrx.com/#]cheap cialis[/url]
    buying cialis
    [url=http://buywcialisnrx.com/#”>buy cialis online

  56. Pingback: first time butt plug
  57. Pingback: Security Firm
  58. Pingback: super head honcho
  59. Pingback: rotating vibrator
  60. Pingback: dark desires g spot
  61. Pingback: money making tips
  62. Pingback: auto taxi
  63. buy tadalafil dosage
    [url=http://buywcialisnrx.com/#]cialis online[/url]
    buy cialis online without a prescription buy
    [url=http://buywcialisnrx.com/#”>buy cheap cialis online

  64. Pingback: oral sex stimulator
  65. Pingback: waterproof vibrator
  66. Pingback: datumoufukuiken
  67. viagra pills canada cialis 20mg buy
    [url=http://cialissknrx.com/#]buy cialis online[/url]
    order cialis online without a prescription grapefruit juice
    [url=http://cialissknrx.com/#”>buy cheap cialis coupon

  68. Pingback: Rechnungswesen
  69. canada cialis generic alpha blockers
    [url=http://cialissknrx.com/#]cheap cialis[/url]
    search cialis generic cialis
    [url=http://cialissknrx.com/#”>generic cialis online

  70. walgreens cialis online pharmacy
    [url=http://cialissknrx.com/#]cheap cialis[/url]
    cialis tadalafil buy
    [url=http://cialissknrx.com/#”>buy generic cialis

  71. Pingback: buy pure kona coffee
  72. walmart tadalafil cialis generic
    [url=http://cialisdenrx.com/#]buy cheap cialis coupon[/url]
    get cialis presСЃriСЂtion and order cialis online
    [url=http://cialisdenrx.com/#”>buy generic cialis

  73. Pingback: pure gourmet coffee
  74. Pingback: interracial porn
  75. cialis 20mg side effects
    [url=http://cialisdenrx.com/#]generic cialis online[/url]
    metformin expiration cialis generic pills used
    [url=http://cialisdenrx.com/#”>buy cialis

  76. cheap cialis for sale
    [url=http://cialissknrx.com/#]generic cialis[/url]
    non prescription erectile dysfunction drugs cialis generic
    [url=http://cialissknrx.com/#”>buy generic cialis

  77. generic cialis 20mg best buy cancun cialis
    [url=http://cialisdenrx.com/#]buy cheap cialis coupon[/url]
    buy cialis
    [url=http://cialisdenrx.com/#”>cheap cialis

  78. montreal cialis generic
    [url=http://cialissknrx.com/#]buy cialis online[/url]
    and what cialis pills look like
    [url=http://cialissknrx.com/#”>cialis

  79. imodium alternative cialis 20mg
    [url=http://cialisdenrx.com/#]buy cialis online[/url]
    order cialis online without a prescription alpha blockers cialis
    [url=http://cialisdenrx.com/#”>buy cialis online

  80. Pingback: Baby Highchair
  81. buy tadalafil online cialis
    [url=http://cialisdenrx.com/#]buy generic cialis[/url]
    women who take cialis pharmacy cialis
    [url=http://cialisdenrx.com/#”>buy cialis

  82. cialis splitting tablets
    [url=http://cialisdenrx.com/#]cialis coupon[/url]
    indian cialis generic levitra
    [url=http://cialisdenrx.com/#”>cheap cialis