Unable to connect to Redis with "limited" user
When trying to use the ACL feature in Redis I'm unable to connect using the dev user below. The admin user works fine, and if I change the dev user to have the +@all flag it works too:
users.acl
user admin on >asecretpassword ~* &* +@all
user dev on >anothersecretpassword ~* &* -@all +@read +@write
I've tested the connection using redis-cli and it works fine with both users, however, using the following connection string does not allow me to connect to Redis using Stackexchange.Redis (yes, I'm deliberately using port 7000)
myserver:7000,user=dev,password=anothersecretpassword
Is there some other permission needed when connecting?
Error message when connecting (using StackExchange.Redis version 2.5.61)
StackExchange.Redis.RedisConnectionException
HResult=0x80131500
Message=It was not possible to connect to the redis server(s). Error connecting right now. To allow this multiplexer to continue retrying until it's able to connect, use abortConnect=false in your connection string or AbortOnConnectFail=false; in your code.
Source=StackExchange.Redis
StackTrace:
at StackExchange.Redis.ConnectionMultiplexer.ConnectImpl(ConfigurationOptions configuration, TextWriter log, Nullable`1 serverType)
at StackExchange.Redis.ConnectionMultiplexer.Connect(ConfigurationOptions configuration, TextWriter log)
at StackExchange.Redis.ConnectionMultiplexer.Connect(String configuration, TextWriter log)
...my internal code
Redis is running inside Kubernetes, the output from the the Redis info server command reads:
# Server
redis_version:6.2.6
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:5b326c4b337eb561
redis_mode:standalone
os:Linux 4.15.0-173-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:c11-builtin
gcc_version:8.3.0
process_id:1
process_supervised:no
run_id:0d8aaca6d744f505baeaa1981a57614906f74f89
tcp_port:7000
server_time_usec:1650368852664123
uptime_in_seconds:548
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:6201684
executable:/redis-server
config_file:/opt/bitnami/redis/etc/redis.conf
io_threads_active:0
Alright, checked using MONITOR what commands that were sent to the server.
1650378734.447932 [0 10.209.118.11:54998] "AUTH" "(redacted)" "(redacted)"
1650378734.447966 [0 10.209.118.11:54996] "AUTH" "(redacted)" "(redacted)"
1650378734.475334 [0 10.209.118.11:54998] "ECHO" "7R\xcf\x98 b3E\x82O\x02\xab\x18\x04\xcf\xab"
1650378734.475365 [0 10.209.118.11:54998] "SUBSCRIBE" "__Booksleeve_MasterChanged"
1650378734.475539 [0 10.209.118.11:54996] "INFO" "replication"
1650378734.475556 [0 10.209.118.11:54996] "INFO" "server"
1650378734.475575 [0 10.209.118.11:54996] "ECHO" "7R\xcf\x98 b3E\x82O\x02\xab\x18\x04\xcf\xab"
1650378734.528086 [0 10.209.118.11:54996] "INFO" "replication"
So changing permissions to
user dev on >anothersecretpassword ~* &* -@all +@pubsub +@read +@write +echo +info solved it. I guess the issue could be closed now, but maybe it should be documented somewhere what the miniumum permissions needed for connecting using StackExchange.Redis are.
@lasso Thanks for the follow-up here. I'm adding some docs in #2225 for others hitting this scenario :)