4 ms·
You can setup http authentication to your redis instance which provides at least some sort of security. Also, you can lock your servers down to only accept conn
by dchuk 14y ago
You can setup http authentication to your redis instance which provides at least some sort of security. Also, you can lock your servers down to only accept connections from specific IPs (so like your app servers are the only ones allowed access to your Redis server). Those two things combined are a good start for security at the very least.
- thibaut_barrere 14y agoThe culprit here is that restricting connections is often not possible at all if the Redis provider is different from the provider used for the rest of the app (eg: using Heroku/DotCloud + RedisToGo or similar, etc) - that's my main issue here. You can do this if you use AWS security groups, or if your PaaS support similar stuff, but not all do support it so far, if I read right...
- dchuk 14y agoRedis is really really easy to host yourself. I'm not much of a fan of outsourcing infrastructure items though, so I am biased
- thibaut_barrere 14y agoI'm not contesting that Redis is easy to host yourself - I host it myself on some projects, use Chef to provision servers etc. If you choose to use the cloud though (PaaS etc) to save time on the rest of your app, then pick a manually managed server for Redis, it kind of defeat the purpose, plus you won't be able to easily follow the changes on the rest of the PaaS infrastructure (eg: change of servers with access right etc).
- joevandyk 14y agoYes. But it's much simpler to rely the existing security protections you already use for your database, instead of having to setup new ones with a completely different system for your async jobs.