Redis: Access Control List(ACL) – [Complex Permission for Users]

In this article, we are discussing all the aspects of Redis ACL(Access Control List). Redis ACL allows us to set permission for a user, in detail. Permission for all the parts(key, command, channel, etc.) can be set separately.

NOTES

• We know that the default user in Redis is named “default“.
• We have discussed the password-setting process for the “default” user, in a separate article. If you don’t need a complex permission setting for the “default” user, then check the link below-

Check Redis “default” User Authentication

In this article, we are discussing how we can create/update/delete new users, set passwords, and set complex permission for a Redis user. Let’s check Redis ACL in detail-

Check User Access

Let’s check all the existing users in the Redis server-

127.0.0.1:6379> acl users
1) "default"
2) "bigboxuser"

To check who is the currently authenticated user, use the “acl whoami” command-

127.0.0.1:6379> acl whoami
"default"

To check the list of all users with full permission details, use the command “acl list“-

127.0.0.1:6379> acl list
1) "user default on nopass ~* &* +@all"
2) "user bigboxuser on #9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 ~s* -@all +get"

Here are what all the parts of the output mean-

The following sections discuss the permission in detail. Keep reading, everything will be clear to you about ACL.

Permission Details

User permission and access information has the following parts-

• User name
• Status (active/inactive)
• Password
• Key permission (which keys can the user access)
• Command permission (which commands can the user execute)
• Channel permission (which channels can the user access)
• Selector

Permission Parts/Sections

The most important parts of the permission are the password, key permission, command permission, and channels.

Each of these sections starts with a different symbol.

Here is how to identify which part is for which rule/permission-

User Status

Here are the statuses that we can use for user in Redis-

User Password

A user can have multiple passwords for authentication.

User password control-

Key Pattern

The permission part for keys starts with “~” symbol.

The <pattern> used here follows the Glob pattern. So we need to set these patterns following all the rules that apply to Globbing.

For example: “~*” pattern means, we are allowing all the keys. Also “allkeys” is an alias of “~*“.

Channel Pattern

The permission part for channels starts with “&” symbol.

The <pattern> used here follows the Glob pattern. So we need to set these patterns following all the rules that apply to Globbing.

Command permission

Commands allow/disallow-

To allow/deny a subcommand of a command we can use the “|” and write it like this –
+<command>|<subcommand> : to allow the subcommand
-<command>|<subcommand>: to deny/disallow the subcommand

For example, if we want to restrict a user to the “rewrite” subcommand of the “config” command, then we can use “-config|rewrite” for the command permission.

Command Category

Use the command below to get the list of command categories-

127.0.0.1:6379> acl cat
 1) "keyspace"
 2) "read"
 3) "write"
 4) "set"
 5) "sortedset"
 6) "list"
 7) "hash"
# .
# .
# .
# Lot more command categories are shown after this.
# We are not showing all to save space.
# The full list of commands are below.

To get the list of commands that belong to a category use the following Redis command-

# Here we are trying to get the commands that belong to "keyspace" category
127.0.0.1:6379> acl cat keyspace
 1) "expire"
 2) "rename"
 3) "migrate"
 4) "scan"
 5) "flushdb"
# .
# .
# .
# Lot more commands are shown after this.
# We are not showing all to save space.

Here is the list of command categories with descriptions and subcommands-

Redis Command: ACL SETUSER – Set User Access

ACL SETUSER commands are not logged and kept in history. This is done to avoid security issues(like showing passwords and/or other sensitive info in the log).

Let’s create a user and set access for that user-

acl setuser bigboxuser on >bigboxpass ~* +@all &*

Let’s create another user with limited access-

 acl setuser bigboxuser2 on >somecomplexpass ~product:* +@read +@write

To reset all allowed keys for the user, use the following command-

acl setuser bigboxuser resetkeys

This will reset the allowed key parts only. Other permissions (for command, channel, etc.) will be as it is.

Let’s add permission to allow access key that starts with “user:” and “customer:”

acl setuser bigboxuser ~user:* ~customer:*

Let’s remove user access to all commands-

acl setuser bigboxuser -@all

# or the following command can be used, these are exactly same commands
# acl setuser bigboxuser nocommands

Let’s create another password for the user-

acl setuser bigboxuser >anotherpass

After execution of this command, 2 passwords will be enabled for the user “bigboxuser”. Any one of those passwords can be used to authenticate.

Redis Command: AUTH – Authenticate user

To authenticate the user “bigboxuser” we can use the “AUTH” command like below-

auth bigboxuser bigboxpass

The “AUTH” command has signature – “AUTH [username] [password]“

Redis Command: ACL GETUSER – Get User Access Details

Use the command “acl getuser [username]” to get the details of user access-

127.0.0.1:6379> acl getuser default
 1) "flags"
 2) 1) "on"
    2) "nopass"
 3) "passwords"
 4) (empty array)
 5) "commands"
 6) "+@all"
 7) "keys"
 8) "~*"
 9) "channels"
10) "&*"
11) "selectors"
12) (empty array)

Here are the detail meaning of the output-

Redis Command: ACL DELUSER – Delete User

Use the command “acl deluser [username]” to delete the user, like below-

127.0.0.1:6379> ACL DELUSER bigboxuser
(integer) 1

The default user (user name “default”) can not be deleted.

Deleting a user does not reflect immediately, just after the command is applied. The user will see the change after logout from the current session.

Redis Command: ACL DRYRUN– Simulate Execution

Signature:

ACL DRYRUN <username> <command> <args….>

Usage:

Simulate a command execution, and used to check if the user can execute certain commands or not.

This command only checks the permission, the command is not actually executed.

Return Type:

Examples:

Use this command to simulate a command execution on behalf of a user, without actually executing the command. Check the example commands below-

# We are authenticated as the default user

127.0.0.1:6379> get site:name
"bigboxcode"

# Let's remove all command psermission for user bigboxuser 
127.0.0.1:6379> acl setuser bigboxuser nocommands
OK

# Check if user can execute a command, "get" command for eample in this case
127.0.0.1:6379> acl dryrun bigboxuser get site:name
"This user has no permissions to run the 'get' command"

# User can not execute this command as he does not have any permission

# Let's give only get command permission
127.0.0.1:6379> acl setuser bigboxuser +get
OK

# Now let's check with acl dryrun
127.0.0.1:6379> acl dryrun bigboxuser get site:name
OK

# Let's check if set command can be used - it gives error
127.0.0.1:6379> acl dryrun bigboxuser set site:name "change name"
"This user has no permissions to run the 'set' command"

# Give write permission to user
127.0.0.1:6379> acl setuser bigboxuser +@write
OK

# Check if user can execute the set comand.
127.0.0.1:6379> acl dryrun bigboxuser set site:name "change site name"
OK
# now user can execute set command

# Check if the original value is changed (should not change as acl dryrun only simulates the command
127.0.0.1:6379> get site:name
"bigboxcode"

Methods for Managing ACL

There are 3 ways we can set the access permission of a user-

Let’s take a look at the each of the methods-

Method #1: Using ACL commands from “redis-cli”

We have already discussed the process of how to set ACL from “redis-cli”. All the above commands can be used to manage ACL in the Redis server.

ACL data may be lost on server restart if set using redis-cli.

Method #2: In “redis.conf” file directly

We can directly set the permission by adding lines like “user ………” in the redis config file.

For example, we can add the following lines-

user firstuser on >somepass12 ~* +@all &*
user seconduser on >someotherpass1122 ~cus* +get

Method #3: In a separate ACL file

We can use a separate file for ACL. For that, we have to enable the external file for ACL in the Redis config file. In Redis config file (redis.conf) look for the following line-

aclfile /etc/redis/users.acl

# The file path can be anything. Just look for the "aclfile" part.

If the line is commented, then remove the comment symbol and enable the line. Then change the file path if required.

Create the file in the correct path and then add lines like below-

user firstuser on >somepass ~* +@all &*
user seconduser on >someotherpass ~user* +get

Examples