Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improvement to redis socket security #121

Merged
merged 1 commit into from Jul 1, 2020
Merged

Conversation

samuel-emrys
Copy link
Contributor

Currently, permissions for the redis socket are 777; access for everyone. This presents a security vulnerability that allows any user to read cached data. I've modified the permissions to 770. To facilitate this I moved the socket to /var/run/redis, which is a directory with ownership redis:redis. This solves the problem of having it in /tmp, where the ownership of the socket is redis:wheel. The change in directory permissions allows other users to be added to the redis group without unnecessarily providing a user with the permissions of wheel.

Namely, it allows the www user to be added to the redis group, which allows the removal of any permissions to "other" users.

If you have any feedback let me know :)

…nly. Moved redis socket to /var/run/redis/redis.sock and added the www user to the redis group
@samuel-emrys
Copy link
Contributor Author

@danb35 what are your thoughts?

@danb35 danb35 merged commit 27140d3 into danb35:master Jul 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants