Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Username support in redis configuration #529

Open
aval13 opened this issue Oct 12, 2022 · 1 comment
Open

Username support in redis configuration #529

aval13 opened this issue Oct 12, 2022 · 1 comment
Labels
enhancement New feature or request

Comments

@aval13
Copy link

aval13 commented Oct 12, 2022

Describe the bug

The redis authentication configuration only supports password, not username and password (as supported by Redis).
Redis since version 6 supports multiple users with ACL per user.
Redis 7 (shipped by icingadb-redis package) specifies "requirepass" is deprecated and it is only for compatibility reasons since it only defines the password for the "default" user in Redis.

To Reproduce

Setup multiple users in Redis (one for Icinga2 icingadb feature, one for icingadb, one for icingaweb) using:
user ... acl rules ...
This will disable the requirepass configuration option.
Try to use one of the users which are not called "default".
There is no "username" option in the configuration file.

Expected behavior

I should be able to specify a username in the redis configuration.

Your Environment

Include as many relevant details about the environment you experienced the problem in

  • Icinga DB version: 1.0.0-1.focal
  • Icinga 2 version: 2.13.5-1.focal
  • Operating System and version: Ubuntu Server 20.04 Focal

Additional context

I would have opened a feature request, but the New issue only allows me to open a Bug report.
Security wise, it would be good practice to setup in Redis a dedicated user for Icinga2 icingadb feature with write access, and a separate user for icingadb-web with only read access (which can also be used by icingadb for instance).
From what I can tell, you are using redis-go v7 branch which supports username specification in https://github.com/go-redis/redis/blob/v7/options.go
I guess once a username parameter in the configuration yaml is supported, with default value "default", then add it via connection.NewRDBWrapper to use in redis.NewClient.
It would use the explicit user "default" if no "username" entry in the configuration file, or the value specified if so.

This may also require a change in icingadb-web since the configuration can also be seen there.

It is very possible I do not fully understand things about Icinga very well, so please correct me if I'm wrong.

@aval13
Copy link
Author

aval13 commented Oct 12, 2022

This is related to Icinga/icinga2#9536

@Al2Klimov Al2Klimov added the enhancement New feature or request label May 24, 2023
@Al2Klimov Al2Klimov changed the title No username support in redis configuration Username support in redis configuration May 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants