“NOAUTH Authentication required”、“WRONGPASS invalid username-password pair or user is disabled”、“ERR AUTH
> GET k
(error) NOAUTH Authentication required.
认证之前执行 PING -> NOAUTH
认证之前执行 ECHO x -> NOAUTH
认证之前执行 INFO -> NOAUTH
认证之前执行 SELECT 1 -> NOAUTH
认证之前执行 CLIENT SETNAME -> NOAUTH
认证之前执行 COMMAND COUNT -> NOAUTH
认证之前执行 HELLO 2 -> NOAUTH
认证之前执行 AUTH secret -> 可用
认证之前执行 RESET -> 可用
认证之前执行 QUIT -> 可用设了 requirepass 的实例,认证之前几乎所有命令都被拒绝,包括 PING 和 HELLO。健康检查要带密码。
> AUTH wrong
(error) WRONGPASS invalid username-password pair or user is disabled.
> AUTH default wrong
(error) WRONGPASS invalid username-password pair or user is disabled.
> AUTH nosuchuser secret
(error) WRONGPASS invalid username-password pair or user is disabled.
> AUTH secret
"OK"
> GET k
(nil)
> AUTH anything
(error) ERR AUTH <password> called without any password configured for the default user. Are you sure your configuration is correct?
> AUTH default anything
"OK"
> GET k
(nil)密码错、用户不存在、用户被禁用报同一条 WRONGPASS;没设密码的实例上单参数 AUTH 报 ERR,而 AUTH default <任意> 返回 OK。
> SET app:1 x
"OK"
> SET other:1 x
(error) NOPERM No permissions to access a key
> DEL app:1
(error) NOPERM User app has no permissions to run the 'del' command
> PUBLISH news:today hi
(integer) 0
> PUBLISH secret:ch hi
(error) NOPERM No permissions to access a channel
> EVAL return redis.call('GET', 'other:1') 0
(error) NOPERM User app has no permissions to run the 'eval' command
> MGET app:1 other:1
(error) NOPERM User app has no permissions to run the 'mget' command
ACL LOG(管理员查看拒绝记录)前 4 条的 reason / object / username:
reason=command context=toplevel object=mget username=app
reason=command context=toplevel object=eval username=app
reason=channel context=toplevel object=secret:ch username=app
reason=command context=toplevel object=del username=app
> AUTH app apppw
(error) WRONGPASS invalid username-password pair or user is disabled.key、命令、频道三种授权失败的文本不同,管理员可用 ACL LOG 看到被拒绝的原因和对象。
旧连接(用 secret 认证过)GET k -> (nil) CONFIG SET requirepass newpass 之后,旧连接 GET k -> (nil) 新连接 AUTH secret(旧密码)-> (error) WRONGPASS invalid username-password pair or user is disabled. 新连接 AUTH newpass -> "OK",GET k -> (nil) CONFIG SET requirepass "" 清空之后,全新连接不认证直接 GET k -> (nil)
已认证的连接不受影响;新连接只认新密码;requirepass 设空就是不再要求认证。
AUTH <密码> -> OK;之后 PING -> "PONG" AUTH default <密码> -> OK;之后 PING -> "PONG" HELLO 2 AUTH default <密码> -> OK;之后 PING -> "PONG" HELLO 2 AUTH default wrong -> (error) WRONGPASS invalid username-password pair or user is disabled. redis-cli -p 8140 -a secret PING -> stdout='PONG',stderr="Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe." redis-cli -p 8140 PING(不带密码)-> stdout='NOAUTH Authentication required.',stderr='' 环境变量 REDISCLI_AUTH=secret,redis-cli -p 8140 PING -> stdout='PONG',stderr=''
AUTH、AUTH default、HELLO 都行;redis-cli -a 会有安全警告,REDISCLI_AUTH 环境变量没有。