Cannot set password for redis sentinel 3.2 #3279

chaintng · 2016-05-29T02:48:10Z

I tried to set up redis sentinel to make it has high availability and support fail over.
I begin by setup the redis replication (1 master and 2 slaves in 3 ec2-instances)

And after that, i install redis-sentinel service for each instance.

However, when i tried to access redis-sentinal remotely (from my local machine)
It shows following message

DENIED Redis is running in protected mode because protected mode is enabled, no bind address was specified, no authentication password is requested to clients....

So, i tried to set requirepass in sentinel.conf.
But after i run redis-cli -h REDIS-IP -a PASSWORD -p SENTINEL_PORT INFO

It shows following

NOAUTH Authentication required.

Is there anyway i could connect to redis-sentinel remotely?

Please advise.

The text was updated successfully, but these errors were encountered:

srhitesh · 2016-06-14T10:43:53Z

I could not find any parameter like requirepass in sentinel.conf file. Did you configure redis.conf with password.
Can you explain configuration bit more.

jordanjennings · 2016-06-16T12:47:31Z

It looks like you can use requirepass in sentinel.conf to kind of set a password, except the sentinel doesn't understand the AUTH command to be able to authenticate. When I set a password on sentinel and try to AUTH it says:

ERR unknown command 'AUTH'

If I don't set a password then protected mode kicks in. If I explicitly set bind 0.0.0.0 in the config file then protected mode is disabled, but then sentinel isn't secure.

How should I be setting a password for sentinel?

srhitesh · 2016-06-20T09:43:13Z

+1

I have configured in sentinel.conf with requirepass "foobared" and tried access with below command. i Could see the same output as chainta reported above.

hitesh@BLR1000009988:~/redis-3.2$ redis-cli -h 10.18.220.224 -a foobared -p 26379 INFO
NOAUTH Authentication required.

After that i tried to login with CLI and gave auth with password.

hitesh@BLR1000009988:~/redis-3.2$redis-cli -p 26379
27.0.0.1:26379> info
NOAUTH Authentication required.
127.0.0.1:26379> auth hitesh123
(error) ERR unknown command 'auth'

From above behavior we can find that first info messages was understood by sentinel and forwarded to Redis Server. So we got the NOAUTH Reply. But once we tried to give the Auth password as we give in case of redis client or server Auth. Sentinel itself could not understand and throwing the Error message.

Sentinel itself do not have any configs by default to support authentication. Since sentinel is built kind of wrapper over the redis-server and so all configs are accessible, the authentication feature can be enabled manually adding the configuration requirepass in sentinel.conf And then we need to add the AUTH command to the sentinel's supported command list for it to work properly. Committing same here to fix redis#3279

rojingeorge · 2016-06-20T10:28:00Z

@srhitesh, Thanks for you analysis. Hope the above PR solves this issue.

skyscooby · 2016-06-22T03:30:13Z

+1.. just spent couple hours to arrive at same conclusion :/

chaintng · 2016-06-22T03:42:27Z

Thanks a lot! You guys rock!

skyscooby · 2016-06-22T03:54:26Z

Another option could be to set sentinels to 'protected-mode no' as default if they have no path to getting or setting data in the actual redis nodes..

antirez · 2016-07-05T13:56:10Z

Hello, updating Sentinel to accept AUTH is not currently the right solution because there is no way then in order to instruct the other Sentinels to access it via authentication. All the Sentinels should at least share the same password, because we use auto discovery between Sentinels, so is a currently unsolved problem. AFAIK the real issue here is that the protected mode message is misleading in the case of Redis Sentinel. It is not clear at all that Sentinel does not support AUTH. So perhaps it may be better to just change the message AND at the same time to throw an error when requirepass is used in Sentinel mode inside the configuration file.

skyscooby · 2016-07-05T16:32:29Z

But the problem is the sentinels can not talk to each other and determine
state when configured to use Auth against the a redis cluster . They
connect to the cluster fine and discover each other through redis but they
try and connect to each other and get a message saying AUTH required and
failover doest actually work.. Each individual Sentinel sees the other as down..
This kinda blocks us from using AUTH support in redis so because of this we are
forced to manage access via network ACL's...

On Jul 5, 2016 9:57 AM, "Salvatore Sanfilippo" notifications@github.com
wrote:

Hello, updating Sentinel to accept AUTH is not currently the right
solution because there is no way then in order to instruct the other
Sentinels to access it via authentication. All the Sentinels should at
least share the same password, because we use auto discovery between
Sentinels, so is a currently unsolved problem. AFAIK the real issue
here is that the protected mode message is misleading in the case of Redis
Sentinel. It is not clear at all that Sentinel does not support AUTH. So
perhaps it may be better to just change the message AND at the same time to
throw an error when requirepass is used in Sentinel mode inside the
configuration file.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#3279 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AEPqdxH0IWcoeIi10WDOUd9NiLNXUyiqks5qSmK_gaJpZM4IpMyy
.

rojingeorge · 2016-07-11T07:14:35Z

I think better to support AUTH in sentinel and also add the requirepass in the sentinel's configuration file, so that this can unblock people wishing to use this feature. Also like other password configuration criteria in cluster, we should not care if users have configured different passwords in different sentinels.

cooperaj · 2016-07-18T16:16:53Z

As @skyscooby points out above if you bring up a sentinel group they each enter protected mode under the rules set out for protected mode. You can't then set a password because sentinel doesn't understand auth.

In short, protected mode appears to have broken sentinels.

The only fix I've been able to implement is configuring my sentinels with bind 0.0.0.0. Not the best solution but it'll have to do for now.

antirez · 2016-08-11T17:47:04Z

@cooperaj may I ask you why it is not possible to just use protected-mode no in Sentinel configuration?

cooperaj · 2016-08-12T08:44:26Z

@antirez Our organisations servers sit on an open network. Can't be having the students stumbling across servers and playing with things.

Ideally we could firewall it all off but we have no idea what legitimate user of the service could be.

victorgp · 2017-11-30T21:48:54Z

Is there any advance on this? The redis 3.2 protected mode is useless to protect the sentinels, it is based on binding to a specific interface, if loopback is set there is no way for sentinels in different hosts to work, if it is the main interface, anyone with access to that interface can kill your redis cluster.
As pointed out here #1904

Is as easy as

while true; do redis-cli -p 26379 SENTINEL failover redis_test; sleep 2; done

Supporting the AUTH command seems like a simple change and there is a PR open for that #3329 what is preventing you to go ahead?

jijojv · 2017-12-13T21:56:11Z

@antirez - can you please comment on the one-liner fix in #3329 ?

antirez · 2018-10-31T11:23:36Z

@jijojv AFAIK such patch is broken, I'm checking better how we could resolve this issue.

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to #3279 and #3329.

antirez · 2018-10-31T12:00:19Z

Sentinel password authentication added in fa67525.

So far it was not possible to setup Sentinel with authentication enabled. This commit introduces this feature: every Sentinel will try to authenticate with other sentinels using the same password it is configured to accept clients with. So for instance if a Sentinel has a "requirepass" configuration statemnet set to "foo", it will use the "foo" password to authenticate with every other Sentinel it connects to. So basically to add the "requirepass" to all the Sentinels configurations is enough in order to make sure that: 1) Clients will require the password to access the Sentinels instances. 2) Each Sentinel will use the same password to connect and authenticate with every other Sentinel in the group. Related to #3279 and #3329.

rojingeorge · 2018-11-01T01:30:26Z

@antirez Thanks

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to #3279 and #3329.

So far it was not possible to setup Sentinel with authentication enabled. This commit introduces this feature: every Sentinel will try to authenticate with other sentinels using the same password it is configured to accept clients with. So for instance if a Sentinel has a "requirepass" configuration statemnet set to "foo", it will use the "foo" password to authenticate with every other Sentinel it connects to. So basically to add the "requirepass" to all the Sentinels configurations is enough in order to make sure that: 1) Clients will require the password to access the Sentinels instances. 2) Each Sentinel will use the same password to connect and authenticate with every other Sentinel in the group. Related to #3279 and #3329.

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to redis#3279 and redis#3329.

So far it was not possible to setup Sentinel with authentication enabled. This commit introduces this feature: every Sentinel will try to authenticate with other sentinels using the same password it is configured to accept clients with. So for instance if a Sentinel has a "requirepass" configuration statemnet set to "foo", it will use the "foo" password to authenticate with every other Sentinel it connects to. So basically to add the "requirepass" to all the Sentinels configurations is enough in order to make sure that: 1) Clients will require the password to access the Sentinels instances. 2) Each Sentinel will use the same password to connect and authenticate with every other Sentinel in the group. Related to redis#3279 and redis#3329.

Add a new redis_major_version parameter, and send AUTH commands to Sentinels if a password configured and redis_major_version >= 5. redis_major_version arbitrarily defaults to 3, which maintains the existing behavior of not sending AUTH to Sentinels ever. Update README with new parameter/usage and bump rock version. In Redis 3.x and 4.x, Sentinels did not support authentication per redis/redis#3279 redis/redis@fa67525 added authentication support to Sentinel, and this was released to stable in 5.0.1: https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES Because Redis releases <5.0.1 will reject AUTH attempts to Sentinel and clients cannot send INFO without first sending AUTH if required, some mechanism of differentiating client behavior is necessary.

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to redis#3279 and redis#3329.

So far it was not possible to setup Sentinel with authentication enabled. This commit introduces this feature: every Sentinel will try to authenticate with other sentinels using the same password it is configured to accept clients with. So for instance if a Sentinel has a "requirepass" configuration statemnet set to "foo", it will use the "foo" password to authenticate with every other Sentinel it connects to. So basically to add the "requirepass" to all the Sentinels configurations is enough in order to make sure that: 1) Clients will require the password to access the Sentinels instances. 2) Each Sentinel will use the same password to connect and authenticate with every other Sentinel in the group. Related to redis#3279 and redis#3329.

rojingeorge mentioned this issue Jun 20, 2016

Sentinel Password Authentication Fix #3279 #3329

Closed

antirez added the WAITING-OP-REPLY label Jul 5, 2016

Axxiss mentioned this issue Jul 6, 2016

redis-sentinel "DENIED Redis is running in protected mode" #3106

Closed

wmene mentioned this issue Aug 11, 2016

Version 3.2.1 sentinels do not discover each other - permanently sdown #3416

Closed

nrk mentioned this issue Nov 14, 2016

Sentinel nodes auth bug... predis/predis#391

Closed

varas mentioned this issue Apr 6, 2017

replication: sentinel (currently on master branch) launches AUTH to sentinel instances snc/SncRedisBundle#339

Closed

aminet mentioned this issue Apr 20, 2018

As Sentinel doesn't support AUTH command (as of Redis 4.0.7), passwor… nanopack/redundis#4

Open

antirez added a commit that referenced this issue Oct 31, 2018

Disable protected mode in Sentinel mode.

666b343

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to #3279 and #3329.

antirez closed this as completed Oct 31, 2018

antirez added a commit that referenced this issue Nov 5, 2018

Disable protected mode in Sentinel mode.

50222af

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to #3279 and #3329.

JackieXie168 pushed a commit to JackieXie168/redis that referenced this issue Dec 17, 2018

Disable protected mode in Sentinel mode.

77bfb85

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to redis#3279 and redis#3329.

bew mentioned this issue Jun 19, 2019

Sentinel instances read requirepass but don't support AUTH command #1904

Closed

schlitzered mentioned this issue Aug 28, 2019

bugfix, initializing ClusterPool with password schlitzered/pyredis#6

Merged

pulllock pushed a commit to pulllock/redis that referenced this issue Jun 28, 2023

Disable protected mode in Sentinel mode.

a170900

Sentinel must be exposed, so protected mode is just an issue for users in case Redis was started in Sentinel mode. Related to redis#3279 and redis#3329.

Cannot set password for redis sentinel 3.2 #3279

Cannot set password for redis sentinel 3.2 #3279

chaintng commented May 29, 2016

srhitesh commented Jun 14, 2016

jordanjennings commented Jun 16, 2016

srhitesh commented Jun 20, 2016

rojingeorge commented Jun 20, 2016

skyscooby commented Jun 22, 2016

chaintng commented Jun 22, 2016

skyscooby commented Jun 22, 2016 •

edited

antirez commented Jul 5, 2016

skyscooby commented Jul 5, 2016 •

edited

rojingeorge commented Jul 11, 2016

cooperaj commented Jul 18, 2016

antirez commented Aug 11, 2016

cooperaj commented Aug 12, 2016

victorgp commented Nov 30, 2017

jijojv commented Dec 13, 2017

antirez commented Oct 31, 2018

antirez commented Oct 31, 2018

rojingeorge commented Nov 1, 2018

Cannot set password for redis sentinel 3.2 #3279

Cannot set password for redis sentinel 3.2 #3279

Comments

chaintng commented May 29, 2016

srhitesh commented Jun 14, 2016

jordanjennings commented Jun 16, 2016

srhitesh commented Jun 20, 2016

rojingeorge commented Jun 20, 2016

skyscooby commented Jun 22, 2016

chaintng commented Jun 22, 2016

skyscooby commented Jun 22, 2016 • edited

antirez commented Jul 5, 2016

skyscooby commented Jul 5, 2016 • edited

rojingeorge commented Jul 11, 2016

cooperaj commented Jul 18, 2016

antirez commented Aug 11, 2016

cooperaj commented Aug 12, 2016

victorgp commented Nov 30, 2017

jijojv commented Dec 13, 2017

antirez commented Oct 31, 2018

antirez commented Oct 31, 2018

rojingeorge commented Nov 1, 2018

skyscooby commented Jun 22, 2016 •

edited

skyscooby commented Jul 5, 2016 •

edited