diff --git a/content/operate/rs/security/_index.md b/content/operate/rs/security/_index.md index ba0f738a6f..33bbaff747 100644 --- a/content/operate/rs/security/_index.md +++ b/content/operate/rs/security/_index.md @@ -14,16 +14,16 @@ Redis Software provides various features to secure your deployment: | Login and passwords | Users and roles | Encryption and TLS | Certificates and audit | |---------------------|-----------------|--------------------|-----------------------| -| [Password attempts and session timeout]({{}}) | [Cluster and database access explained]({{}}) | [Enable TLS]({{}}) | [Create certificates]({{}}) | -| [Password complexity]({{}}) | [Create users]({{}}) | [Configure TLS protocols]({{}}) | [Monitor certificates]({{}}) | -| [Password expiration]({{}}) | [Create roles]({{}}) | [Configure cipher suites]({{}}) | [Update certificates]({{}}) | -| [Default database access]({{}}) | [Redis ACLs]({{}}) | [Encrypt private keys on disk]({{}}) | [Enable OCSP stapling]({{}}) | -| [Rotate user passwords]({{}}) | [Integrate with LDAP]({{}}) | [Internode encryption]({{}}) | [Audit database connections]({{}}) | -| [Single sign-on (SSO)]({{}}) | | | | +| [Password attempts and session timeout](/content/operate/rs/security/access-control/manage-users/login-lockout.md) | [Cluster and database access explained](/content/operate/rs/security/access-control/_index.md) | [Enable TLS](/content/operate/rs/security/encryption/tls/enable-tls.md) | [Create certificates](/content/operate/rs/security/certificates/create-certificates.md) | +| [Password complexity](/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md) | [Create users](/content/operate/rs/security/access-control/create-users.md) | [Configure TLS protocols](/content/operate/rs/security/encryption/tls/tls-protocols.md) | [Monitor certificates](/content/operate/rs/security/certificates/monitor-certificates.md) | +| [Password expiration](/content/operate/rs/security/access-control/manage-passwords/password-expiration.md) | [Create roles](/content/operate/rs/security/access-control/create-combined-roles.md) | [Configure cipher suites](/content/operate/rs/security/encryption/tls/ciphers.md) | [Update certificates](/content/operate/rs/security/certificates/updating-certificates.md) | +| [Default database access](/content/operate/rs/security/access-control/manage-users/default-user.md) | [Redis ACLs](/content/operate/rs/security/access-control/redis-acl-overview.md) | [Encrypt private keys on disk](/content/operate/rs/security/encryption/pem-encryption.md) | [Enable OCSP stapling](/content/operate/rs/security/certificates/ocsp-stapling.md) | +| [Rotate user passwords](/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md) | [Integrate with LDAP](/content/operate/rs/security/access-control/ldap/_index.md) | [Internode encryption](/content/operate/rs/security/encryption/internode-encryption.md) | [Audit database connections](/content/operate/rs/security/audit-events.md) | +| [Single sign-on (SSO)](/content/operate/rs/security/access-control/saml-sso.md) | | | | ## Recommended security practices -See [Recommended security practices]({{}}) to learn how to protect Redis Software. +See [Recommended security practices](/content/operate/rs/security/recommended-security-practices.md) to learn how to protect Redis Software. ## Redis Trust Center diff --git a/content/operate/rs/security/access-control/_index.md b/content/operate/rs/security/access-control/_index.md index cf27184a92..222dc0be58 100644 --- a/content/operate/rs/security/access-control/_index.md +++ b/content/operate/rs/security/access-control/_index.md @@ -39,12 +39,11 @@ The following diagram shows three different options for roles and users: ## Default database access -When you create a database, [default user access]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}) is enabled automatically. +When you create a database, [default user access](/content/operate/rs/security/access-control/manage-users/default-user.md) is enabled automatically. -If you set up role-based access controls for your database and don't require compatibility with versions earlier than Redis 6, you can [deactivate the default user]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}). +If you set up role-based access controls for your database and don't require compatibility with versions earlier than Redis 6, you can [deactivate the default user](/content/operate/rs/security/access-control/manage-users/default-user.md). -{{}} -Before you [deactivate default user access]({{< relref "/operate/rs/security/access-control/manage-users/default-user#deactivate-default-user" >}}), make sure the role associated with the database is [assigned to a user]({{< relref "/operate/rs/security/access-control/create-users#assign-roles-to-users" >}}). Otherwise, the database will be inaccessible. -{{}} +> [!WARNING] +> Before you [deactivate default user access](/content/operate/rs/security/access-control/manage-users/default-user.md#deactivate-default-user), make sure the role associated with the database is [assigned to a user](/content/operate/rs/security/access-control/create-users.md#assign-roles-to-users). Otherwise, the database will be inaccessible. ## More info diff --git a/content/operate/rs/security/access-control/create-cluster-roles.md b/content/operate/rs/security/access-control/create-cluster-roles.md index 07ad82912b..3330625b08 100644 --- a/content/operate/rs/security/access-control/create-cluster-roles.md +++ b/content/operate/rs/security/access-control/create-cluster-roles.md @@ -14,7 +14,7 @@ Roles with cluster access allow access to the Cluster Management UI and REST API ## Default management roles -Redis Software includes five predefined roles that determine a user's level of access to the Cluster Manager UI and [REST API]({{}}). +Redis Software includes five predefined roles that determine a user's level of access to the Cluster Manager UI and [REST API](/content/operate/rs/references/rest-api/_index.md). 1. **DB Viewer** - Read database settings 1. **DB Member** - Administer databases @@ -24,7 +24,7 @@ Redis Software includes five predefined roles that determine a user's level of a 1. **Admin** - Full cluster access 1. **None** - For data access only - cannot access the Cluster Manager UI or use the REST API -For more details about the privileges granted by each of these roles, see [Cluster Manager UI permissions](#cluster-manager-ui-permissions) or [REST API permissions]({{}}). +For more details about the privileges granted by each of these roles, see [Cluster Manager UI permissions](#cluster-manager-ui-permissions) or [REST API permissions](/content/operate/rs/references/rest-api/permissions.md). ## Cluster Manager UI permissions @@ -77,7 +77,7 @@ To create a role that grants cluster access using the Cluster Manager UI: -tab-sep- -To [create a role]({{}}) that grants cluster access using the REST API: +To [create a role](/content/operate/rs/references/rest-api/requests/roles/_index.md#post-role) that grants cluster access using the REST API: ```sh POST /v1/roles @@ -88,13 +88,13 @@ POST /v1/roles ``` {{< /multitabs >}} -You can [assign the new role to users]({{}}) to grant cluster access. +You can [assign the new role to users](/content/operate/rs/security/access-control/create-users.md#assign-roles-to-users) to grant cluster access. ## Scope a role to specific databases By default, the `db_member` and `db_viewer` [management roles](#default-management-roles) grant access to every database in the cluster. In a shared or multi-tenant cluster, you can scope one of these roles to specific databases so that users assigned the role can view or manage only those databases. -To scope a role, add the `resources` field when you [create]({{}}) or [update]({{}}) a role with the REST API. The `resources` field is a list of resource scopes; each scope has a `type` (currently only `db`) and a `uids` array of the database IDs the role applies to. +To scope a role, add the `resources` field when you [create](/content/operate/rs/references/rest-api/requests/roles/_index.md#post-role) or [update](/content/operate/rs/references/rest-api/requests/roles/_index.md#put-role) a role with the REST API. The `resources` field is a list of resource scopes; each scope has a `type` (currently only `db`) and a `uids` array of the database IDs the role applies to. For example, the following request creates a `db_member` role scoped to databases `1` and `2`: @@ -109,7 +109,7 @@ POST /v1/roles } ``` -When you [assign this role to a user]({{}}): +When you [assign this role to a user](/content/operate/rs/security/access-control/create-users.md#assign-roles-to-users): - The user can view or manage only the databases listed in the role's `resources` scope. @@ -117,6 +117,5 @@ When you [assign this role to a user]({{}} -Database scoping applies to the `db_member` and `db_viewer` management roles. -{{}} +> [!NOTE] +> Database scoping applies to the `db_member` and `db_viewer` management roles. diff --git a/content/operate/rs/security/access-control/create-combined-roles.md b/content/operate/rs/security/access-control/create-combined-roles.md index c47dc0e163..5457ce5ebb 100644 --- a/content/operate/rs/security/access-control/create-combined-roles.md +++ b/content/operate/rs/security/access-control/create-combined-roles.md @@ -34,13 +34,13 @@ To define a Redis ACL rule using the Cluster Manager UI: 1. Enter a descriptive name for the Redis ACL. This will be used to associate the ACL rule with the role. -1. Define the ACL rule. For more information about Redis ACL rules and syntax, see the [Redis ACL overview]({{}}). +1. Define the ACL rule. For more information about Redis ACL rules and syntax, see the [Redis ACL overview](/content/operate/rs/security/access-control/redis-acl-overview.md). 1. Click **Save**. -tab-sep- -To define a Redis ACL rule using the REST API, use a [create Redis ACL]({{}}) request. For more information about Redis ACL rules and syntax, see the [Redis ACL overview]({{}}). +To define a Redis ACL rule using the REST API, use a [create Redis ACL](/content/operate/rs/references/rest-api/requests/redis_acls/_index.md#post-redis_acl) request. For more information about Redis ACL rules and syntax, see the [Redis ACL overview](/content/operate/rs/security/access-control/redis-acl-overview.md). Example request: @@ -66,9 +66,8 @@ To associate the Redis ACL with a role and database, use the `uid` from the resp {{< /multitabs >}} -{{}} -For multi-key commands on multi-slot keys, the return value is `failure`, but the command runs on the keys that are allowed. -{{}} +> [!NOTE] +> For multi-key commands on multi-slot keys, the return value is `failure`, but the command runs on the keys that are allowed. ## Create roles with ACLs and cluster access {#create-role} @@ -90,7 +89,7 @@ To define a role for combined access using the Cluster Manager UI: 1. Enter a descriptive name for the role. This will be used to reference the role when configuring users. -1. Choose a **Management role** other than **None**. For details about permissions granted by each role, see [Cluster Manager UI permissions]({{}}) and [REST API permissions]({{}}). +1. Choose a **Management role** other than **None**. For details about permissions granted by each role, see [Cluster Manager UI permissions](/content/operate/rs/security/access-control/create-cluster-roles.md#cluster-manager-ui-permissions) and [REST API permissions](/content/operate/rs/references/rest-api/permissions.md). Add role with name @@ -108,7 +107,7 @@ To define a role for combined access using the Cluster Manager UI: To define a role for combined access using the REST API: -1. Use a [create role]({{}}) request: +1. Use a [create role](/content/operate/rs/references/rest-api/requests/roles/_index.md#post-role) request: ```sh POST /v1/roles @@ -130,7 +129,7 @@ To define a role for combined access using the REST API: To associate the role with a Redis ACL and database, use the `uid` from the response as the `role_uid` when you add `roles_permissions` to the database. -2. [Update a database's configuration]({{}}) to add `roles_permissions` with the role and Redis ACL: +2. [Update a database's configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) to add `roles_permissions` with the role and Redis ACL: ```sh POST /v1/bdbs/ @@ -147,4 +146,4 @@ To define a role for combined access using the REST API: {{< /multitabs >}} -You can [assign the new role to users]({{}}) to grant database access and access to the Cluster Manager UI and REST API. +You can [assign the new role to users](/content/operate/rs/security/access-control/create-users.md#assign-roles-to-users) to grant database access and access to the Cluster Manager UI and REST API. diff --git a/content/operate/rs/security/access-control/create-db-roles.md b/content/operate/rs/security/access-control/create-db-roles.md index c73ecc9d3f..fc7656bc0f 100644 --- a/content/operate/rs/security/access-control/create-db-roles.md +++ b/content/operate/rs/security/access-control/create-db-roles.md @@ -10,7 +10,7 @@ linkTitle: Create roles with database access only weight: 15 --- -Roles with database access grant the ability to access and interact with a database's data. Database access privileges are determined by defining [Redis ACLs]({{}}) and adding them to roles. +Roles with database access grant the ability to access and interact with a database's data. Database access privileges are determined by defining [Redis ACLs](/content/operate/rs/security/access-control/redis-acl-overview.md) and adding them to roles. To create a role that grants database access without granting access to the Redis Software Cluster Manager UI and REST API: @@ -36,13 +36,13 @@ To define a Redis ACL rule using the Cluster Manager UI: 1. Enter a descriptive name for the Redis ACL. This will be used to associate the ACL rule with the role. -1. Define the ACL rule. For more information about Redis ACL rules and syntax, see the [Redis ACL overview]({{}}). +1. Define the ACL rule. For more information about Redis ACL rules and syntax, see the [Redis ACL overview](/content/operate/rs/security/access-control/redis-acl-overview.md). 1. Click **Save**. -tab-sep- -To define a Redis ACL rule using the REST API, use a [create Redis ACL]({{}}) request. For more information about Redis ACL rules and syntax, see the [Redis ACL overview]({{}}). +To define a Redis ACL rule using the REST API, use a [create Redis ACL](/content/operate/rs/references/rest-api/requests/redis_acls/_index.md#post-redis_acl) request. For more information about Redis ACL rules and syntax, see the [Redis ACL overview](/content/operate/rs/security/access-control/redis-acl-overview.md). Example request: @@ -68,9 +68,8 @@ To associate the Redis ACL with a role and database, use the `uid` from the resp {{< /multitabs >}} -{{}} -For multi-key commands on multi-slot keys, the return value is `failure`, but the command runs on the keys that are allowed. -{{}} +> [!NOTE] +> For multi-key commands on multi-slot keys, the return value is `failure`, but the command runs on the keys that are allowed. ## Create roles with ACLs @@ -108,7 +107,7 @@ To define a role for database access using the Cluster Manager UI: To define a role for database access using the REST API: -1. Use a [create role]({{}}) request: +1. Use a [create role](/content/operate/rs/references/rest-api/requests/roles/_index.md#post-role) request: ```sh POST /v1/roles @@ -130,7 +129,7 @@ To define a role for database access using the REST API: To associate the role with a Redis ACL and database, use the `uid` from the response as the `role_uid` when you add `roles_permissions` to the database. -1. [Update a database's configuration]({{}}) to add `roles_permissions` with the role and Redis ACL: +1. [Update a database's configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) to add `roles_permissions` with the role and Redis ACL: ```sh POST /v1/bdbs/ @@ -147,4 +146,4 @@ To define a role for database access using the REST API: {{< /multitabs >}} -You can [assign the new role to users]({{}}) to grant database access. +You can [assign the new role to users](/content/operate/rs/security/access-control/create-users.md#assign-roles-to-users) to grant database access. diff --git a/content/operate/rs/security/access-control/create-users.md b/content/operate/rs/security/access-control/create-users.md index 55a2f46e32..3af0fb630b 100644 --- a/content/operate/rs/security/access-control/create-users.md +++ b/content/operate/rs/security/access-control/create-users.md @@ -14,9 +14,9 @@ weight: 10 Before you create other users: -1. Review the [access control overview]({{}}) to learn how to use role-based access control (RBAC) to manage users' cluster access and database access. +1. Review the [access control overview](/content/operate/rs/security/access-control/_index.md) to learn how to use role-based access control (RBAC) to manage users' cluster access and database access. -1. Create roles you can assign to users. See [Create roles with cluster access only]({{}}), [Create roles with database access only]({{}}), or [Create roles with combined access]({{}}) for instructions. +1. Create roles you can assign to users. See [Create roles with cluster access only](/content/operate/rs/security/access-control/create-cluster-roles.md), [Create roles with database access only](/content/operate/rs/security/access-control/create-db-roles.md), or [Create roles with combined access](/content/operate/rs/security/access-control/create-combined-roles.md) for instructions. ## Add users @@ -28,11 +28,11 @@ To add a user to the cluster: 1. Enter the name, email, and password of the new user. - {{< note >}} -- Usernames must contain ASCII characters only. - -- To use [single sign-on (SSO)]({{< relref "/operate/rs/security/access-control/saml-sso" >}}), users must have email addresses. - {{< /note >}} + > [!NOTE] + > - Usernames must contain ASCII characters only. + > + > - To use [single sign-on (SSO)](/content/operate/rs/security/access-control/saml-sso.md), users must have email addresses. + > {{Create user panel with fields for username, email, password, and alerts.}} @@ -74,8 +74,8 @@ Assign a role, associated with specific databases and access control lists (ACLs Depending on the type of the user's assigned role (cluster management role or data access role), the user can now: -- [Connect to a database]({{< relref "/operate/rs/databases/connect" >}}) associated with the role and run limited Redis commands, depending on the role's Redis ACLs. +- [Connect to a database](/content/operate/rs/databases/connect/_index.md) associated with the role and run limited Redis commands, depending on the role's Redis ACLs. - Sign in to the Redis Software Cluster Manager UI. -- Make a [REST API]({{< relref "/operate/rs/references/rest-api" >}}) request. +- Make a [REST API](/content/operate/rs/references/rest-api/_index.md) request. diff --git a/content/operate/rs/security/access-control/disable-basic-authentication.md b/content/operate/rs/security/access-control/disable-basic-authentication.md index da786752f7..b3b86d8709 100644 --- a/content/operate/rs/security/access-control/disable-basic-authentication.md +++ b/content/operate/rs/security/access-control/disable-basic-authentication.md @@ -14,31 +14,29 @@ By default, the Redis Software cluster management REST API accepts HTTP Basic au When you disable basic authentication, the cluster rejects Basic and Digest authentication on all inbound REST API requests, and clients must authenticate with a client certificate (mTLS) or a JSON Web Token (JWT) instead. This reduces the cluster's attack surface by removing password-based access to the management API. -{{}} -This setting applies only to the cluster management REST API. It does not change how clients authenticate to databases. -{{}} +> [!NOTE] +> This setting applies only to the cluster management REST API. It does not change how clients authenticate to databases. ## Before you begin -{{}} -Before you disable basic authentication, make sure every client and tool that calls the REST API can still authenticate another way. If you disable basic authentication without another working method in place, you lose REST API access to the cluster. -{{}} +> [!WARNING] +> Before you disable basic authentication, make sure every client and tool that calls the REST API can still authenticate another way. If you disable basic authentication without another working method in place, you lose REST API access to the cluster. When basic authentication is disabled, other configured authentication methods—such as certificate-based (mTLS), JWT, and LDAP—continue to work. Set up at least one before you disable basic authentication: -- **Certificate-based (mTLS) authentication** (recommended) — see [Certificate-based authentication]({{}}). +- **Certificate-based (mTLS) authentication** (recommended) — see [Certificate-based authentication](/content/operate/rs/security/certificates/certificate-based-authentication.md). -- **JWT authentication** — obtain a token with an [authorize user]({{}}) request, then send it as a bearer token on subsequent requests. +- **JWT authentication** — obtain a token with an [authorize user](/content/operate/rs/references/rest-api/requests/users/authorize.md) request, then send it as a bearer token on subsequent requests. Some cluster-management flows support **certificate credentials** when Basic and Digest authentication are disabled or unavailable. These flows don't use JWT or LDAP: -- **Joining a node to the cluster** and **Active-Active database management.** Configure these flows to use certificate credentials (client certificate, client key, and trusted CA) instead of a username and password. The client certificate's signing CA must be present in the cluster's `mtls_trusted_ca`. See [Certificate-based authentication for cluster management]({{}}). +- **Joining a node to the cluster** and **Active-Active database management.** Configure these flows to use certificate credentials (client certificate, client key, and trusted CA) instead of a username and password. The client certificate's signing CA must be present in the cluster's `mtls_trusted_ca`. See [Certificate-based authentication for cluster management](/content/operate/rs/security/certificates/certificate-based-authentication.md#certificate-based-authentication-for-cluster-management). ### Follow this order Set up and verify certificate-based authentication *before* you disable basic authentication. If you disable it first, you can lock yourself out of the cluster and out of Active-Active database management. -1. Enable certificate-based authentication on the cluster (`mtls_certificate_authentication`) and add the client certificate's signing CA to the cluster's `mtls_trusted_ca`. See [Set up certificate-based authentication for the REST API]({{}}). +1. Enable certificate-based authentication on the cluster (`mtls_certificate_authentication`) and add the client certificate's signing CA to the cluster's `mtls_trusted_ca`. See [Set up certificate-based authentication for the REST API](/content/operate/rs/security/certificates/certificate-based-authentication.md#set-up-certificate-based-authentication-for-the-rest-api). 1. Verify that certificate authentication works *while basic authentication is still enabled*. Enabling certificate-based authentication is additive—it doesn't disable password-based access: @@ -53,7 +51,7 @@ Set up and verify certificate-based authentication *before* you disable basic au curl --cacert --cert client.pem --key client.key https://:9443/v1/cluster ``` -1. Configure certificate credentials for each participating cluster whose basic authentication you're disabling. Use either a username and password or certificate credentials per cluster—not both—so participating clusters can migrate one at a time. See [Manage an Active-Active database]({{}}). +1. Configure certificate credentials for each participating cluster whose basic authentication you're disabling. Use either a username and password or certificate credentials per cluster—not both—so participating clusters can migrate one at a time. See [Manage an Active-Active database](/content/operate/rs/security/certificates/certificate-based-authentication.md#manage-an-active-active-database). 1. Disable basic authentication. @@ -67,7 +65,7 @@ Basic authentication is enabled by default (`control_plane_basic_authentication` tab1="REST API" tab2="rladmin" >}} -To disable basic authentication using the REST API, use an [update cluster settings]({{< relref "/operate/rs/references/rest-api/requests/cluster#put-cluster" >}}) request: +To disable basic authentication using the REST API, use an [update cluster settings](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) request: ```sh PUT https://:/v1/cluster @@ -78,7 +76,7 @@ PUT https://:/v1/cluster -tab-sep- -To disable basic authentication using [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune" >}}): +To disable basic authentication using [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md): ```sh rladmin tune cluster control_plane_basic_authentication disabled @@ -103,9 +101,8 @@ curl -k --cert --key https://:/v1/cluster ## Re-enable basic authentication -{{}} -If disabling basic authentication left you without cluster access, use the `rladmin` method below. It runs locally on a cluster node and doesn't require REST API access. -{{}} +> [!NOTE] +> If disabling basic authentication left you without cluster access, use the `rladmin` method below. It runs locally on a cluster node and doesn't require REST API access. To re-enable basic authentication, use one of the following methods: diff --git a/content/operate/rs/security/access-control/ldap/_index.md b/content/operate/rs/security/access-control/ldap/_index.md index a74a425a9a..ccef5873ea 100644 --- a/content/operate/rs/security/access-control/ldap/_index.md +++ b/content/operate/rs/security/access-control/ldap/_index.md @@ -13,9 +13,9 @@ title: LDAP authentication weight: 50 --- -Redis Software supports [Lightweight Directory Access Protocol](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol) (LDAP) authentication and authorization through its [role-based access controls]({{< relref "/operate/rs/security/access-control" >}}) (RBAC). You can use LDAP to authorize access to the Cluster Manager UI and to control database access. +Redis Software supports [Lightweight Directory Access Protocol](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol) (LDAP) authentication and authorization through its [role-based access controls](/content/operate/rs/security/access-control/_index.md) (RBAC). You can use LDAP to authorize access to the Cluster Manager UI and to control database access. -You can configure LDAP roles using the Redis Software Cluster Manager UI or [REST API]({{< relref "/operate/rs/references/rest-api/requests/ldap_mappings/" >}}). +You can configure LDAP roles using the Redis Software Cluster Manager UI or [REST API](/content/operate/rs/references/rest-api/requests/ldap_mappings/_index.md). ## How it works @@ -56,26 +56,26 @@ Before you enable LDAP in Redis Software, you need: 1. The LDAP groups that correspond to the levels of access you wish to authorize. Each LDAP group will be mapped to a Redis Software access control role. -1. A Redis Software access control role for each LDAP group. Before you enable LDAP, you need to set up [role-based access controls]({{< relref "/operate/rs/security/access-control" >}}) (RBAC). +1. A Redis Software access control role for each LDAP group. Before you enable LDAP, you need to set up [role-based access controls](/content/operate/rs/security/access-control/_index.md) (RBAC). ## Enable LDAP To enable LDAP: -1. From **Access Control > LDAP** in the Cluster Manager UI, select the **Configuration** tab and [enable LDAP access]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}). +1. From **Access Control > LDAP** in the Cluster Manager UI, select the **Configuration** tab and [enable LDAP access](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md). {{Configure LDAP screen}} -2. Map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}). +2. Map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md). -3. Update database access control lists (ACLs) to [authorize role access]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}). +3. Update database access control lists (ACLs) to [authorize role access](/content/operate/rs/security/access-control/ldap/update-database-acls.md). If you already have appropriate roles, you can update them to include LDAP groups. ## More info -- Enable and configure [role-based LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}) -- Map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}) -- Update database ACLs to [authorize LDAP access]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}) -- Learn more about Redis Software [security and practices]({{< relref "/operate/rs/security/" >}}) +- Enable and configure [role-based LDAP](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md) +- Map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md) +- Update database ACLs to [authorize LDAP access](/content/operate/rs/security/access-control/ldap/update-database-acls.md) +- Learn more about Redis Software [security and practices](/content/operate/rs/security/_index.md) diff --git a/content/operate/rs/security/access-control/ldap/certificate-based-authentication.md b/content/operate/rs/security/access-control/ldap/certificate-based-authentication.md index 738a5ece8b..8e4bea6eaf 100644 --- a/content/operate/rs/security/access-control/ldap/certificate-based-authentication.md +++ b/content/operate/rs/security/access-control/ldap/certificate-based-authentication.md @@ -21,19 +21,19 @@ Here's how it works: Before enabling certificate-based authentication for LDAP, you must complete the following prerequisites: -1. [Enable mutual TLS]({{}}) for the relevant databases to set up certificate-based authentication. +1. [Enable mutual TLS](/content/operate/rs/security/encryption/tls/enable-tls.md) for the relevant databases to set up certificate-based authentication. -1. [Set up LDAP for the cluster]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap#set-up-ldap-connection" >}}). +1. [Set up LDAP for the cluster](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md#set-up-ldap-connection). -1. [Map LDAP users to appropriate cluster roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}). +1. [Map LDAP users to appropriate cluster roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md). -1. [Configure database ACLs]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}) to authorize LDAP users. +1. [Configure database ACLs](/content/operate/rs/security/access-control/ldap/update-database-acls.md) to authorize LDAP users. ## Set up certificate-based authentication for LDAP To set up certificate-based authentication for LDAP: -1. Enable certificate-based authentication in the cluster LDAP configuration using an [update LDAP configuration]({{}}) REST API request. +1. Enable certificate-based authentication in the cluster LDAP configuration using an [update LDAP configuration](/content/operate/rs/references/rest-api/api-reference.md#tag/Cluster/operation/cluster_update_ldap_config) REST API request. To perform LDAP lookup for certificate-authenticated users: @@ -78,7 +78,7 @@ The certificate subject must include the OID. {{}} -1. Enable external certificate-based authentication in cluster settings using an [update cluster settings]({{}}) REST API request: +1. Enable external certificate-based authentication in cluster settings using an [update cluster settings](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT https://:/v1/cluster @@ -89,4 +89,4 @@ The certificate subject must include the OID. ## Verify your setup -After configuration is complete, try to [connect to the database with certificate-based authentication]({{}}) and verify your setup. +After configuration is complete, try to [connect to the database with certificate-based authentication](/content/operate/rs/security/certificates/certificate-based-authentication.md#authenticate-database-connections) and verify your setup. diff --git a/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md b/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md index 0a5b217147..50339a7146 100644 --- a/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md +++ b/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md @@ -11,9 +11,9 @@ description: Describes how role-based LDAP authentication and authorization work weight: 25 --- -Redis Software uses a role-based mechanism to authorize users authenticated with LDAP authentication or with certificate-based authentication (CBA). You map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}), and each user receives the access level of the role mapped to their group. +Redis Software uses a role-based mechanism to authorize users authenticated with LDAP authentication or with certificate-based authentication (CBA). You map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md), and each user receives the access level of the role mapped to their group. -Role-based LDAP authorizes both cluster management users (previously known as _external users_) and database users. To authenticate users with client certificates instead of passwords, see [certificate-based authentication for LDAP]({{< relref "/operate/rs/security/access-control/ldap/certificate-based-authentication" >}}). +Role-based LDAP authorizes both cluster management users (previously known as _external users_) and database users. To authenticate users with client certificates instead of passwords, see [certificate-based authentication for LDAP](/content/operate/rs/security/access-control/ldap/certificate-based-authentication.md). ## How role-based LDAP works @@ -23,7 +23,7 @@ When a user signs in with LDAP credentials, Redis Software runs three steps. Eac 1. **Authenticate** — Redis Software finds the user's directory entry and verifies the supplied password by binding to the LDAP server as that user. Configure this under [Authentication query](#authentication-query). -1. **Authorize** — Redis Software finds the group or groups the user belongs to, then matches them against the groups you mapped to roles under [LDAP mappings]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}). The user receives the access level of the matched group's role. Configure this under [Authorization query](#authorization-query). +1. **Authorize** — Redis Software finds the group or groups the user belongs to, then matches them against the groups you mapped to roles under [LDAP mappings](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md). The user receives the access level of the matched group's role. Configure this under [Authorization query](#authorization-query). If authentication succeeds but no group matches a mapping, Redis Software denies access. A common symptom is the user being redirected to a change-password screen. @@ -235,6 +235,6 @@ After you save, sign in to the Cluster Manager UI, or connect to a database with ## More info -- Map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}) -- Update database ACLs to [authorize LDAP access]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}) -- Learn more about Redis Software [security and practices]({{< relref "/operate/rs/security/" >}}) +- Map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md) +- Update database ACLs to [authorize LDAP access](/content/operate/rs/security/access-control/ldap/update-database-acls.md) +- Learn more about Redis Software [security and practices](/content/operate/rs/security/_index.md) diff --git a/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md b/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md index 48675c1366..b8ce86cdb0 100644 --- a/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md +++ b/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md @@ -20,9 +20,9 @@ To map LDAP groups to access control roles in the Cluster Manager UI: 1. Select **Access Control > LDAP > Mapping**. - {{}} -You can map LDAP roles when LDAP configuration is not enabled, but they won't have any effect until you [configure and enable LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}). - {{}} + > [!NOTE] + > You can map LDAP roles when LDAP configuration is not enabled, but they won't have any effect until you [configure and enable LDAP](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md). + > {{Enable LDAP mappings Panel}} @@ -52,6 +52,6 @@ The scope of the authorization depends on the access control role: ## More info -- Enable and configure [role-based LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}) -- Update database ACLs to [authorize LDAP access]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}) -- Learn more about Redis Software [security and practices]({{< relref "/operate/rs/security/" >}}) +- Enable and configure [role-based LDAP](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md) +- Update database ACLs to [authorize LDAP access](/content/operate/rs/security/access-control/ldap/update-database-acls.md) +- Learn more about Redis Software [security and practices](/content/operate/rs/security/_index.md) diff --git a/content/operate/rs/security/access-control/ldap/migrate-to-role-based-ldap.md b/content/operate/rs/security/access-control/ldap/migrate-to-role-based-ldap.md index 4bfcefc8d4..fecc552d30 100644 --- a/content/operate/rs/security/access-control/ldap/migrate-to-role-based-ldap.md +++ b/content/operate/rs/security/access-control/ldap/migrate-to-role-based-ldap.md @@ -10,7 +10,7 @@ description: Describes how to migrate existing cluster-based LDAP deployments to weight: 55 --- -Redis Software supports LDAP through a [role-based mechanism]({{< relref "/operate/rs/security/access-control/ldap/" >}}), first introduced [in v6.0.20]({{< relref "/operate/rs/release-notes/rs-6-0-20-april-2021" >}}). +Redis Software supports LDAP through a [role-based mechanism](/content/operate/rs/security/access-control/ldap/_index.md), first introduced [in v6.0.20](/content/operate/rs/release-notes/rs-6-0-20-april-2021.md). Earlier versions of Redis Software supported a cluster-based mechanism; however, that mechanism was removed in v6.2.12. @@ -58,17 +58,17 @@ This checklist covers the basic process: To test your LDAP integration, you can: -- Connect with `redis-cli` and use the [`AUTH` command]({{< relref "/commands/auth" >}}) to test LDAP username/password credentials. +- Connect with `redis-cli` and use the [`AUTH` command](/content/commands/auth.md) to test LDAP username/password credentials. - Sign in to the Cluster Manager UI using LDAP credentials authorized for admin access. -- Use [Redis Insight]({{< relref "/develop/tools/insight" >}}) to access a database using authorized LDAP credentials. +- Use [Redis Insight](/content/develop/tools/insight/_index.md) to access a database using authorized LDAP credentials. -- Use the [REST API]({{< relref "/operate/rs/references/rest-api" >}}) to connect using authorized LDAP credentials. +- Use the [REST API](/content/operate/rs/references/rest-api/_index.md) to connect using authorized LDAP credentials. ## More info -- Enable and configure [role-based LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap" >}}) -- Map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles" >}}) -- Update database ACLs to [authorize LDAP access]({{< relref "/operate/rs/security/access-control/ldap/update-database-acls" >}}) -- Learn more about Redis Software [security and practices]({{< relref "/operate/rs/security/" >}}) +- Enable and configure [role-based LDAP](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md) +- Map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md) +- Update database ACLs to [authorize LDAP access](/content/operate/rs/security/access-control/ldap/update-database-acls.md) +- Learn more about Redis Software [security and practices](/content/operate/rs/security/_index.md) diff --git a/content/operate/rs/security/access-control/ldap/update-database-acls.md b/content/operate/rs/security/access-control/ldap/update-database-acls.md index 00cd9f4961..fd06f0cbc7 100644 --- a/content/operate/rs/security/access-control/ldap/update-database-acls.md +++ b/content/operate/rs/security/access-control/ldap/update-database-acls.md @@ -31,6 +31,6 @@ As a result, we recommend ordering roles so that higher access roles appear befo ## More info -- Enable and configure [role-based LDAP]({{< relref "/operate/rs/security/access-control/ldap/enable-role-based-ldap.md" >}}) -- Map LDAP groups to [access control roles]({{< relref "/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md" >}}) -- Learn more about Redis Software [security and practices]({{< relref "/operate/rs/security/" >}}) +- Enable and configure [role-based LDAP](/content/operate/rs/security/access-control/ldap/enable-role-based-ldap.md) +- Map LDAP groups to [access control roles](/content/operate/rs/security/access-control/ldap/map-ldap-groups-to-roles.md) +- Learn more about Redis Software [security and practices](/content/operate/rs/security/_index.md) diff --git a/content/operate/rs/security/access-control/manage-passwords/_index.md b/content/operate/rs/security/access-control/manage-passwords/_index.md index b60d5aaff9..f63ee693f4 100644 --- a/content/operate/rs/security/access-control/manage-passwords/_index.md +++ b/content/operate/rs/security/access-control/manage-passwords/_index.md @@ -14,16 +14,15 @@ weight: 30 Redis Software provides several ways to manage the passwords of local accounts, including: -- [Password complexity rules]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}) +- [Password complexity rules](/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md) -- [Password expiration]({{< relref "/operate/rs/security/access-control/manage-passwords/password-expiration" >}}) +- [Password expiration](/content/operate/rs/security/access-control/manage-passwords/password-expiration.md) -- [Password rotation]({{< relref "/operate/rs/security/access-control/manage-passwords/rotate-passwords" >}}) +- [Password rotation](/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md) -You can also manage a user's ability to [sign in]({{< relref "/operate/rs/security/access-control/manage-users/login-lockout#user-login-lockout" >}}) and control [session timeout]({{< relref "/operate/rs/security/access-control/manage-users/login-lockout#session-timeout" >}}). +You can also manage a user's ability to [sign in](/content/operate/rs/security/access-control/manage-users/login-lockout.md#user-login-lockout) and control [session timeout](/content/operate/rs/security/access-control/manage-users/login-lockout.md#session-timeout). -To enforce more advanced password policies, we recommend using [LDAP integration]({{< relref "/operate/rs/security/access-control/ldap" >}}) with an external identity provider, such as Active Directory. +To enforce more advanced password policies, we recommend using [LDAP integration](/content/operate/rs/security/access-control/ldap/_index.md) with an external identity provider, such as Active Directory. -{{}} -Redis Software securely stores all user passwords using a cryptographic hash function. The default password hashing algorithm is `SHA-256`, but you can [change the password hashing algorithm]({{}}) to `PBKDF2` as of Redis Software version 7.8.6-13. -{{}} +> [!NOTE] +> Redis Software securely stores all user passwords using a cryptographic hash function. The default password hashing algorithm is `SHA-256`, but you can [change the password hashing algorithm](/content/operate/rs/security/access-control/manage-passwords/password-hashing-algorithm.md) to `PBKDF2` as of Redis Software version 7.8.6-13. diff --git a/content/operate/rs/security/access-control/manage-passwords/active-active-admin-credentials.md b/content/operate/rs/security/access-control/manage-passwords/active-active-admin-credentials.md index 7977e1d023..0a3cac5fe6 100644 --- a/content/operate/rs/security/access-control/manage-passwords/active-active-admin-credentials.md +++ b/content/operate/rs/security/access-control/manage-passwords/active-active-admin-credentials.md @@ -12,15 +12,14 @@ weight: 90 Active-Active databases use administrator credentials to manage operations. When you change the administrator password on clusters with Active-Active databases, you must update the Active-Active database configuration to prevent authentication failures during Active-Active management operations. -{{}} -Do not perform any management operations on the databases until these steps are complete. -{{}} +> [!WARNING] +> Do not perform any management operations on the databases until these steps are complete. To update the administrator password on a cluster with Active-Active databases: 1. From the user management page, update the administrator user password on the clusters you want to update. -1. Run [`crdb-cli crdb list`]({{}}) to find the `CRDB-GUID` that uniquely identifies each Active-Active database and the fully qualified domain names (`FQDN`) of each participating cluster: +1. Run [`crdb-cli crdb list`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/list.md) to find the `CRDB-GUID` that uniquely identifies each Active-Active database and the fully qualified domain names (`FQDN`) of each participating cluster: ```sh crdb-cli crdb list @@ -34,7 +33,7 @@ To update the administrator password on a cluster with Active-Active databases: 4053a0dd-a4a5-4f38-b135-75b7a2dc7331 my-aa-db 2 fqdn2.example.com ``` -1. Update the Active-Active database credentials using the [`crdb-cli crdb update`]({{< relref "/operate/rs/references/cli-utilities/crdb-cli/crdb/update" >}}) command: +1. Update the Active-Active database credentials using the [`crdb-cli crdb update`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md) command: ```sh crdb-cli crdb update \ diff --git a/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md b/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md index 5e5ff68111..58e281fcbd 100644 --- a/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md +++ b/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md @@ -40,7 +40,7 @@ To enable password complexity rules, use one of the following methods: 1. Select **Save**. -- [Update cluster]({{}}) REST API request: +- [Update cluster](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT https://[host][:port]/v1/cluster @@ -69,7 +69,7 @@ To change the minimum password length, use one of the following methods: 1. Click **Save**. -- [Update cluster]({{}}) REST API request: +- [Update cluster](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT https://[host][:port]/v1/cluster @@ -88,7 +88,7 @@ To deactivate password complexity rules, use one of the following methods: 1. Select **Save**. -- [Update cluster]({{}}) REST API request: +- [Update cluster](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT https://[host][:port]/v1/cluster diff --git a/content/operate/rs/security/access-control/manage-passwords/password-expiration.md b/content/operate/rs/security/access-control/manage-passwords/password-expiration.md index fa55de3f02..5efbc0f1e7 100644 --- a/content/operate/rs/security/access-control/manage-passwords/password-expiration.md +++ b/content/operate/rs/security/access-control/manage-passwords/password-expiration.md @@ -14,9 +14,8 @@ weight: 50 ## Enable password expiration -{{}} -Password expiration is calculated from the time the password was last updated, not from when the policy is enabled. Passwords that were set long enough ago to already be expired will immediately be locked out when you enable this policy. Before enabling password expiration, verify all user passwords have been updated recently enough to avoid immediate lockouts. -{{}} +> [!WARNING] +> Password expiration is calculated from the time the password was last updated, not from when the policy is enabled. Passwords that were set long enough ago to already be expired will immediately be locked out when you enable this policy. Before enabling password expiration, verify all user passwords have been updated recently enough to avoid immediate lockouts. To enforce an expiration of a user's password after a specified number of days: diff --git a/content/operate/rs/security/access-control/manage-passwords/password-hashing-algorithm.md b/content/operate/rs/security/access-control/manage-passwords/password-hashing-algorithm.md index 2a690dd13a..89dbe14172 100644 --- a/content/operate/rs/security/access-control/manage-passwords/password-hashing-algorithm.md +++ b/content/operate/rs/security/access-control/manage-passwords/password-hashing-algorithm.md @@ -13,11 +13,11 @@ weight: 95 Redis Software securely stores all user passwords using a cryptographic hash function. The default password hashing algorithm is `SHA-256`, but `PBKDF2` is also supported as of Redis Software version 7.8.6-13. -You can change the password hashing algorithm using [`rladmin`]({{}}) or the [REST API]({{}}). When you change the password hashing algorithm, the cluster rehashes the administrator password and passwords for all users, including default users. +You can change the password hashing algorithm using [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) or the [REST API](/content/operate/rs/references/rest-api/_index.md). When you change the password hashing algorithm, the cluster rehashes the administrator password and passwords for all users, including default users. ## Command-line method -To change the password hashing algorithm from the command line, run [`rladmin cluster change_password_hashing_algorithm`]({{}}): +To change the password hashing algorithm from the command line, run [`rladmin cluster change_password_hashing_algorithm`](/content/operate/rs/references/cli-utilities/rladmin/cluster/change_password_hashing_algorithm.md): ```sh rladmin cluster change_password_hashing_algorithm PBKDF2 @@ -25,7 +25,7 @@ rladmin cluster change_password_hashing_algorithm PBKDF2 ## REST API method -You can [change the password hashing algorithm]({{}}) using a REST API request: +You can [change the password hashing algorithm](/content/operate/rs/references/rest-api/requests/cluster/change_password_hashing_algorithm.md#patch-change-password-hashing-algorithm) using a REST API request: ```sh PATCH /v1/cluster/change_password_hashing_algorithm diff --git a/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md b/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md index f6b7d79188..378ad62900 100644 --- a/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md +++ b/content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md @@ -11,18 +11,17 @@ toc: 'true' weight: 70 --- -Redis Software lets you implement password rotation policies using the [REST API]({{< relref "/operate/rs/references/rest-api" >}}). +Redis Software lets you implement password rotation policies using the [REST API](/content/operate/rs/references/rest-api/_index.md). You can add a new password for a database user without immediately invalidating the old one to prevent possible authentication errors in production. -{{< note >}} -Password rotation does not work for the default user. [Add additional users]({{< relref "/operate/rs/security/access-control/create-users" >}}) to enable password rotation. -{{< /note >}} +> [!NOTE] +> Password rotation does not work for the default user. [Add additional users](/content/operate/rs/security/access-control/create-users.md) to enable password rotation. ## Password rotation policies For user access to the Redis Software Cluster Manager UI, -you can set a [password expiration policy]({{< relref "/operate/rs/security/access-control/manage-passwords/password-expiration" >}}) to prompt the user to change their password. +you can set a [password expiration policy](/content/operate/rs/security/access-control/manage-passwords/password-expiration.md) to prompt the user to change their password. However, for database connections that rely on password authentication, you need to allow for authentication with the existing password while you roll out the new password to your systems. @@ -31,13 +30,12 @@ With the Redis Software REST API, you can add additional passwords to your user After the old password is replaced in the database connections, you can delete the old password to finish the password rotation process. -{{< warning >}} -Multiple passwords are only supported using the REST API. -If you reset the password for a user in the Cluster Manager UI, -the new password replaces all other passwords for that user. -{{< /warning >}} +> [!WARNING] +> Multiple passwords are only supported using the REST API. +> If you reset the password for a user in the Cluster Manager UI, +> the new password replaces all other passwords for that user. -The new password cannot already exist as a password for the user and must meet the [password complexity]({{< relref "/operate/rs/security/access-control/manage-passwords/password-complexity-rules" >}}) requirements, if enabled. +The new password cannot already exist as a password for the user and must meet the [password complexity](/content/operate/rs/security/access-control/manage-passwords/password-complexity-rules.md) requirements, if enabled. ## Rotate password @@ -45,7 +43,7 @@ Admins can rotate passwords for any user. If you are not an admin, you can only To rotate passwords: -1. Add an additional password to a user's password list with [`POST /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#add-password" >}}). +1. Add an additional password to a user's password list with [`POST /v1/users/password`](/content/operate/rs/references/rest-api/requests/users/password.md#add-password). ```sh POST https://:/v1/users/password @@ -58,7 +56,7 @@ To rotate passwords: After you send this request, the user can authenticate with both the old and the new password. 1. Update the password in all database connections that connect with the user account. -1. Delete the original password with [`DELETE /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#delete-password" >}}): +1. Delete the original password with [`DELETE /v1/users/password`](/content/operate/rs/references/rest-api/requests/users/password.md#delete-password): ```sh DELETE https://:/v1/users/password @@ -75,7 +73,7 @@ To rotate passwords: You can replace all existing passwords for your account with a single password that does not match any existing passwords. Admins can reset passwords for any user. This can be helpful if you suspect that your passwords are compromised and you want to quickly resecure the account. -To replace a user's passwords, use [`PUT /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#update-password" >}}). +To replace a user's passwords, use [`PUT /v1/users/password`](/content/operate/rs/references/rest-api/requests/users/password.md#update-password). ```sh PUT https://:/v1/users/password diff --git a/content/operate/rs/security/access-control/manage-users/default-user.md b/content/operate/rs/security/access-control/manage-users/default-user.md index dde80bf0e1..221d22d7d1 100644 --- a/content/operate/rs/security/access-control/manage-users/default-user.md +++ b/content/operate/rs/security/access-control/manage-users/default-user.md @@ -11,7 +11,7 @@ toc: 'true' weight: 60 --- -When you [create a database]({{< relref "/operate/rs/databases/create" >}}), default user database access is enabled by default (**Unauthenticated access** is selected). This gives the default user full access to the database and enables compatibility with versions of Redis before Redis 6. +When you [create a database](/content/operate/rs/databases/create.md), default user database access is enabled by default (**Unauthenticated access** is selected). This gives the default user full access to the database and enables compatibility with versions of Redis before Redis 6. Select **Password-only authentication**, then enter and confirm a default database password to require authentication for connections to the database. @@ -19,7 +19,7 @@ Select **Password-only authentication**, then enter and confirm a default databa ## Authenticate as default user -When you configure a password for your database, all connections to the database must authenticate using the [AUTH]({{< relref "/commands/auth" >}}) command. See Redis security's [authentication]({{}}) section for more information. +When you configure a password for your database, all connections to the database must authenticate using the [AUTH](/content/commands/auth.md) command. See Redis security's [authentication](/content/operate/oss_and_stack/management/security/_index.md#authentication) section for more information. ```sh AUTH @@ -39,13 +39,12 @@ To change the default user's password: ## Deactivate default user -If you set up [role-based access control]({{< relref "/operate/rs/security/access-control" >}}) with [access control lists]({{< relref "/operate/rs/security/access-control/create-db-roles" >}}) (ACLs) for your database and don't require backwards compatibility with versions earlier than Redis 6, you can [deactivate the default user]({{< relref "/operate/rs/security/access-control/manage-users/default-user" >}}). +If you set up [role-based access control](/content/operate/rs/security/access-control/_index.md) with [access control lists](/content/operate/rs/security/access-control/create-db-roles.md) (ACLs) for your database and don't require backwards compatibility with versions earlier than Redis 6, you can [deactivate the default user](/content/operate/rs/security/access-control/manage-users/default-user.md). -{{}} -- Before you deactivate default user access, make sure the role associated with the database is [assigned to a user]({{< relref "/operate/rs/security/access-control/create-users" >}}). Otherwise, the database will be inaccessible. - -- If you enabled the default database password during the creation of an [Active-Active database]({{< relref "/operate/rs/databases/active-active" >}}), you should not turn off the default database password because it could prevent the removal of participating database instances. -{{}} +> [!WARNING] +> - Before you deactivate default user access, make sure the role associated with the database is [assigned to a user](/content/operate/rs/security/access-control/create-users.md). Otherwise, the database will be inaccessible. +> +> - If you enabled the default database password during the creation of an [Active-Active database](/content/operate/rs/databases/active-active/_index.md), you should not turn off the default database password because it could prevent the removal of participating database instances. To deactivate the default user: diff --git a/content/operate/rs/security/access-control/manage-users/login-lockout.md b/content/operate/rs/security/access-control/manage-users/login-lockout.md index 5d563eefde..0fef5d814a 100644 --- a/content/operate/rs/security/access-control/manage-users/login-lockout.md +++ b/content/operate/rs/security/access-control/manage-users/login-lockout.md @@ -21,11 +21,11 @@ Here, you learn how to configure the relevant settings. ## User login lockout -By default, after 5 failed login attempts within 15 minutes, the user account is locked for 30 minutes. You can change the user login lockout settings in the Cluster Manager UI or with [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}). +By default, after 5 failed login attempts within 15 minutes, the user account is locked for 30 minutes. You can change the user login lockout settings in the Cluster Manager UI or with [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md). ### View login lockout settings -You can view the cluster's user login lockout settings from **Cluster > Security > Preferences > Lockout threshold** in the Cluster Manager UI or with [`rladmin info cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/info#info-cluster" >}}): +You can view the cluster's user login lockout settings from **Cluster > Security > Preferences > Lockout threshold** in the Cluster Manager UI or with [`rladmin info cluster`](/content/operate/rs/references/cli-utilities/rladmin/info.md#info-cluster): ```sh $ rladmin info cluster | grep login_lockout @@ -64,7 +64,7 @@ To change the number of failed login attempts allowed before the user account is - [Cluster Manager UI](#configure-user-login-lockout) -- [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}): +- [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster): ```sh rladmin tune cluster login_lockout_threshold @@ -88,7 +88,7 @@ To change the amount of time during which failed login attempts are counted, use - [Cluster Manager UI](#configure-user-login-lockout) -- [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}): +- [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster): ```sh rladmin tune cluster login_lockout_counter_reset_after @@ -106,7 +106,7 @@ To change the amount of time that the user account is locked after excessive fai - [Cluster Manager UI](#configure-user-login-lockout) -- [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}): +- [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster): ```sh rladmin tune cluster login_lockout_duration @@ -153,7 +153,7 @@ To unlock a user account in the Cluster Manager UI: -tab-sep- -To unlock a user account or reset a user password with `rladmin`, run the [`rladmin cluster reset_password`]({{}}) command: +To unlock a user account or reset a user password with `rladmin`, run the [`rladmin cluster reset_password`](/content/operate/rs/references/cli-utilities/rladmin/cluster/reset_password.md) command: ```sh rladmin cluster reset_password @@ -161,7 +161,7 @@ rladmin cluster reset_password -tab-sep- -To unlock a user account or reset a user password with the REST API, use [`PUT /v1/users`]({{< relref "/operate/rs/references/rest-api/requests/users#put-user" >}}): +To unlock a user account or reset a user password with the REST API, use [`PUT /v1/users`](/content/operate/rs/references/rest-api/requests/users/_index.md#put-user): ```sh PUT /v1/users @@ -188,7 +188,7 @@ To turn off user login lockout using the Cluster Manager UI: -tab-sep- -To turn off user login lockout using `rladmin`, run the [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}) command: +To turn off user login lockout using `rladmin`, run the [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster) command: ```sh rladmin tune cluster login_lockout_threshold 0 @@ -218,7 +218,7 @@ To configure the session timeout using the Cluster Manager UI: -tab-sep- -To configure the session timeout using `rladmin`, run the [`rladmin cluster config`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/config" >}}) command: +To configure the session timeout using `rladmin`, run the [`rladmin cluster config`](/content/operate/rs/references/cli-utilities/rladmin/cluster/config.md) command: ```sh rladmin cluster config cm_session_timeout_minutes diff --git a/content/operate/rs/security/access-control/redis-acl-overview.md b/content/operate/rs/security/access-control/redis-acl-overview.md index 6d1b38dd42..c9307102eb 100644 --- a/content/operate/rs/security/access-control/redis-acl-overview.md +++ b/content/operate/rs/security/access-control/redis-acl-overview.md @@ -22,7 +22,7 @@ Redis ACLs are defined by a set of rules where you specify the commands or comma ### Commands and categories -Redis ACL rules can allow or block specific [Redis commands]({{< relref "/commands" >}}) or [command categories]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#command-categories). +Redis ACL rules can allow or block specific [Redis commands](/commands) or [command categories](/content/operate/oss_and_stack/management/security/acl.md#command-categories). - `+` includes commands @@ -40,9 +40,9 @@ The following example allows all `read` commands and the `SET` command: For database versions earlier than Redis 8.2, module commands have several ACL limitations: -- [Redis modules]({{< relref "/operate/oss_and_stack/stack-with-enterprise" >}}) do not have command categories. +- [Redis modules](/content/operate/oss_and_stack/stack-with-enterprise/_index.md) do not have command categories. -- Other [command category]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#command-categories) ACLs, such as `+@read` and `+@write`, do not include Redis module commands. `+@all` is the only exception because it allows all Redis commands. +- Other [command category](/content/operate/oss_and_stack/management/security/acl.md#command-categories) ACLs, such as `+@read` and `+@write`, do not include Redis module commands. `+@all` is the only exception because it allows all Redis commands. - You have to include individual module commands in a Redis ACL rule to allow them. @@ -72,7 +72,7 @@ The following example allows read and write access to all keys that start with " ### Pub/sub channels -The `&` prefix allows access to [pub/sub channels]({{< relref "/develop/pubsub" >}}) (only supported for databases with Redis version 6.2 or later). +The `&` prefix allows access to [pub/sub channels](/content/develop/pubsub/_index.md) (only supported for databases with Redis version 6.2 or later). To limit access to specific channels, include `resetchannels` before the allowed channels: @@ -82,7 +82,7 @@ resetchannels &channel1 &channel2 ### Selectors -[Selectors]({{< relref "/operate/oss_and_stack/management/security/acl" >}}#selectors) let you define multiple sets of rules in a single Redis ACL (only supported for databases with Redis version 7.2 or later). A command is allowed if it matches the base rule or any selector in the Redis ACL. +[Selectors](/content/operate/oss_and_stack/management/security/acl.md#selectors) let you define multiple sets of rules in a single Redis ACL (only supported for databases with Redis version 7.2 or later). A command is allowed if it matches the base rule or any selector in the Redis ACL. - `()` creates a new selector. @@ -96,7 +96,7 @@ In the following example, the base rule allows `GET key1` and the selector allow ## Default pub/sub permissions -Redis database version 6.2 introduced pub/sub ACL rules that determine which [pub/sub channels]({{< relref "/develop/pubsub" >}}) a user can access. +Redis database version 6.2 introduced pub/sub ACL rules that determine which [pub/sub channels](/content/develop/pubsub/_index.md) a user can access. The configuration option `acl-pubsub-default`, added in Redis Software version 6.4.2, determines the cluster-wide default level of access for all pub/sub channels. Redis Software uses the following pub/sub permissions by default: @@ -124,15 +124,14 @@ To secure pub/sub channels and prepare your cluster for future Redis Software re 1. If any issues occur, you can temporarily change the default pub/sub setting back to permissive. Resolve any problematic ACLs before making pub/sub permissions restrictive again. -{{}} -When you change the cluster's default pub/sub permissions to restrictive, `&*` is added to the **Full Access** ACL. Before you make this change, consider the following: - -- Because pub/sub ACL syntax was added in Redis 6.2, you can't associate the **Full Access** ACL with database versions 6.0 or lower after this change. - -- The **Full Access** ACL is not reverted if you change `acl-pubsub-default` to permissive again. - -- Every database with the default user enabled uses the **Full Access** ACL. -{{}} +> [!NOTE] +> When you change the cluster's default pub/sub permissions to restrictive, `&*` is added to the **Full Access** ACL. Before you make this change, consider the following: +> +> - Because pub/sub ACL syntax was added in Redis 6.2, you can't associate the **Full Access** ACL with database versions 6.0 or lower after this change. +> +> - The **Full Access** ACL is not reverted if you change `acl-pubsub-default` to permissive again. +> +> - Every database with the default user enabled uses the **Full Access** ACL. ### Change default pub/sub permissions @@ -144,7 +143,7 @@ As of Redis Software version 6.4.2, you can configure `acl_pubsub_default`, whic To make default pub/sub permissions restrictive: -1. [Upgrade all databases]({{< relref "/operate/rs/installing-upgrading/upgrading/upgrade-database" >}}) in the cluster to Redis version 6.2 or later. +1. [Upgrade all databases](/content/operate/rs/installing-upgrading/upgrading/upgrade-database.md) in the cluster to Redis version 6.2 or later. 1. Set the default to restrictive (`resetchannels`) using one of the following methods: @@ -163,7 +162,7 @@ To set the default pub/sub permissions using the Cluster Manager UI: -tab-sep- -To set the default pub/sub permissions using `rladmin`, run the [`rladmin tune cluster`]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}) command: +To set the default pub/sub permissions using `rladmin`, run the [`rladmin tune cluster`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster) command: ```sh rladmin tune cluster acl_pubsub_default resetchannels @@ -171,7 +170,7 @@ rladmin tune cluster acl_pubsub_default resetchannels -tab-sep- -To set the default pub/sub permissions using the REST API, use an [update cluster policy]({{< relref "/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy" >}}) request: +To set the default pub/sub permissions using the REST API, use an [update cluster policy](/content/operate/rs/references/rest-api/requests/cluster/policy.md#put-cluster-policy) request: ```sh PUT /v1/cluster/policy @@ -200,14 +199,14 @@ Redis ACLs also have the following differences in Redis Software: To configure passwords in Redis Software, use one of the following methods: - - [`rladmin cluster reset_password`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/reset_password" >}}): + - [`rladmin cluster reset_password`](/content/operate/rs/references/cli-utilities/rladmin/cluster/reset_password.md): ```sh rladmin cluster reset_password ``` - - REST API [`PUT /v1/users`]({{< relref "/operate/rs/references/rest-api/requests/users#put-user" >}}) request and provide `password` + - REST API [`PUT /v1/users`](/content/operate/rs/references/rest-api/requests/users/_index.md#put-user) request and provide `password` ## See also -[Redis ACL rules]({{< relref "/operate/oss_and_stack/management/security/acl" >}}) +[Redis ACL rules](/content/operate/oss_and_stack/management/security/acl.md) diff --git a/content/operate/rs/security/access-control/saml-sso.md b/content/operate/rs/security/access-control/saml-sso.md index 703bf63a24..98bdbeda8b 100644 --- a/content/operate/rs/security/access-control/saml-sso.md +++ b/content/operate/rs/security/access-control/saml-sso.md @@ -22,7 +22,7 @@ When single sign-on is activated, users can sign in to the Redis Software Cluste Before users can sign in to the Cluster Manager UI with SSO, the identity provider admin needs to set up these users on the IdP side with matching email addresses. -With just-in-time (JIT) user provisioning, Redis Software automatically creates user accounts for new users assigned to the SAML application in your identity provider when they sign in to the Cluster Manager UI for the first time. For these users, you must configure the `redisRoleMapping` attribute in your identity provider to assign appropriate roles for [role-based access control]({{}}) during account creation. +With just-in-time (JIT) user provisioning, Redis Software automatically creates user accounts for new users assigned to the SAML application in your identity provider when they sign in to the Cluster Manager UI for the first time. For these users, you must configure the `redisRoleMapping` attribute in your identity provider to assign appropriate roles for [role-based access control](/content/operate/rs/security/access-control/_index.md) during account creation. ### IdP-initiated SSO @@ -72,7 +72,7 @@ To set up SAML single sign-on for a Redis Software cluster: ### Upload SP certificate -1. Create a service provider certificate for Redis Software. See [Create certificates ]({{}}) for instructions. +1. Create a service provider certificate for Redis Software. See [Create certificates ](/content/operate/rs/security/certificates/create-certificates.md#create-certificates) for instructions. 1. Upload the service provider certificate and key to the Redis Software cluster: @@ -94,7 +94,7 @@ To set up SAML single sign-on for a Redis Software cluster: -tab-sep- -To upload a certificate using the REST API, use an [update cluster certificates]({{}}) request. +To upload a certificate using the REST API, use an [update cluster certificates](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md#put-cluster-certificates) request. ```sh PUT https://:/v1/cluster/certificates @@ -141,7 +141,7 @@ To download the service provider's metadata using the Cluster Manager UI: -tab-sep- -To download the service provider's metadata using the REST API, use a [get SAML service provider metadata]({{}}) request. +To download the service provider's metadata using the REST API, use a [get SAML service provider metadata](/content/operate/rs/references/rest-api/requests/cluster/sso.md#get-cluster-sso-saml-metadata) request. ```sh GET https://:/v1/cluster/sso/saml/metadata/sp @@ -175,9 +175,8 @@ See [Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf) for more information about the metadata fields. -{{< note >}} -Redis Software metadata expiration time is equivalent to the SSO service certificate's expiration time. The service provider metadata will only change if the service address used for the Assertion Consumer Service (ACS) and the single logout (SLO) URL is modified. -{{< /note >}} +> [!NOTE] +> Redis Software metadata expiration time is equivalent to the SSO service certificate's expiration time. The service provider metadata will only change if the service address used for the Assertion Consumer Service (ACS) and the single logout (SLO) URL is modified. ### Set up SAML app {#set-up-app} @@ -206,9 +205,9 @@ Set up a SAML app to integrate Redis Software with your identity provider: 1. Optionally, you can enable single log-out (SLO) to allow users to automatically sign out of the the identity provider when they sign out of the Redis Software Cluster Manager UI. Copy the **Single Logout Service** from the **Access Control > Single Sign-On** page in the Cluster Manager UI (`https://:8443/cluster/sso/saml/slo`) and configure it in the SAML app. - {{< note >}} -Redis Software only supports SP-initiated logout, where the user logs out from the Redis Software Cluster Manager UI. IdP-initiated logout requests are not supported. - {{< /note >}} + > [!NOTE] + > Redis Software only supports SP-initiated logout, where the user logs out from the Redis Software Cluster Manager UI. IdP-initiated logout requests are not supported. + > 1. Set up your SAML service provider app so the SAML assertion contains the following attributes: @@ -219,9 +218,9 @@ Redis Software only supports SP-initiated logout, where the user logs out from t | email | User's email address (used as the username in the Redis Software Cluster Manager UI and must contain ASCII characters only.) | | redisRoleMapping | String array that includes the role UID for role-based access control in Redis Software. Only used for just-in-time (JIT) user provisioning. If a user already exists in Redis Software, this attribute is ignored and their existing roles are preserved. | - {{}} -To confirm the identity provider's SAML assertions contain the required attributes, you can use a SAML-tracer web developer tool to inspect them. - {{}} + > [!NOTE] + > To confirm the identity provider's SAML assertions contain the required attributes, you can use a SAML-tracer web developer tool to inspect them. + > 1. Set up any additional configuration required by your identity provider to ensure you can configure the `redisRoleMapping` attribute for SAML users. @@ -262,7 +261,7 @@ tab2="REST API" >}} -tab-sep- -1. Upload your SAML app's assertion signing certificate using an [update cluster certificates]({{}}) REST API request. +1. Upload your SAML app's assertion signing certificate using an [update cluster certificates](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md#put-cluster-certificates) REST API request. ```sh PUT https://:/v1/cluster/certificates @@ -277,7 +276,7 @@ tab2="REST API" >}} } ``` -1. Configure the identity provider metadata using an [update SSO configuration]({{}}) REST API request. +1. Configure the identity provider metadata using an [update SSO configuration](/content/operate/rs/references/rest-api/requests/cluster/sso.md#put-cluster-sso) REST API request. ```sh PUT https://:/v1/cluster/sso @@ -299,9 +298,9 @@ In the identity provider's admin console: 1. Create user profiles in the identity provider for existing Redis Software users. Make sure each user's email address matches in the identity provider and Redis Software. - {{}} -You do not need to configure the `redisRoleMapping` attribute for existing Redis Software users. Their current roles will be preserved, and the `redisRoleMapping` attribute is ignored if provided. - {{}} + > [!NOTE] + > You do not need to configure the `redisRoleMapping` attribute for existing Redis Software users. Their current roles will be preserved, and the `redisRoleMapping` attribute is ignored if provided. + > 2. Assign the new SAML integration app to each user. @@ -323,7 +322,7 @@ To activate single sign-on using the Cluster Manager UI: -tab-sep- -To activate single sign-on using the REST API, use an [update SSO configuration]({{}}) request. +To activate single sign-on using the REST API, use an [update SSO configuration](/content/operate/rs/references/rest-api/requests/cluster/sso.md#put-cluster-sso) request. ```sh PUT https://:/v1/cluster/sso @@ -342,13 +341,13 @@ After single sign-on is activated for Redis Software, you can create new Redis S 1. Configure the `redisRoleMapping` and assign a Redis Software role UID to the user. - {{}} -To see a list of available role UIDs in your cluster, use a REST API request to [get all roles]({{}}): - -```sh -GET https://:/v1/roles -``` - {{}} + > [!NOTE] + > To see a list of available role UIDs in your cluster, use a REST API request to [get all roles](/content/operate/rs/references/rest-api/requests/roles/_index.md#get-all-roles): + > + > ```sh + > GET https://:/v1/roles + > ``` + > 1. Assign the new SAML integration app to the user. @@ -377,7 +376,7 @@ To enforce single sign-on using the Cluster Manager UI: -tab-sep- -To enforce single sign-on using the REST API, use an [update SSO configuration]({{}}) request. +To enforce single sign-on using the REST API, use an [update SSO configuration](/content/operate/rs/references/rest-api/requests/cluster/sso.md#put-cluster-sso) request. ```sh PUT https://:/v1/cluster/sso @@ -400,11 +399,10 @@ If you change certain metadata or configuration settings after you set up SSO, s If your deployment's default service provider address is not accessible to external identity providers, you can change it to an external hostname. -{{}} -If you change the service address, the existing SSO integration will break because the metadata file, SP login and logout URLs, and entity ID will change to match the new address. You must update the service provider configuration on the identity provider's side after this change. -{{}} +> [!WARNING] +> If you change the service address, the existing SSO integration will break because the metadata file, SP login and logout URLs, and entity ID will change to match the new address. You must update the service provider configuration on the identity provider's side after this change. -To change the service provider address, use an [update SSO configuration]({{}}) REST API request: +To change the service provider address, use an [update SSO configuration](/content/operate/rs/references/rest-api/requests/cluster/sso.md#put-cluster-sso) REST API request: ```sh PUT https://:/v1/cluster/sso @@ -431,7 +429,7 @@ To deactivate single sign-on using the Cluster Manager UI: -tab-sep- -To deactivate single sign-on using the REST API, use an [update SSO configuration]({{}}) request. +To deactivate single sign-on using the REST API, use an [update SSO configuration](/content/operate/rs/references/rest-api/requests/cluster/sso.md#put-cluster-sso) request. ```sh PUT https://:/v1/cluster/sso diff --git a/content/operate/rs/security/audit-events.md b/content/operate/rs/security/audit-events.md index 19ab4ea968..9f152713b9 100644 --- a/content/operate/rs/security/audit-events.md +++ b/content/operate/rs/security/audit-events.md @@ -57,7 +57,7 @@ Before enabling auditing on any database, configure the audit destination using tab1="REST API" tab2="rladmin" >}} -To configure the audit destination using the REST API, use an [update database auditing]({{< relref "/operate/rs/references/rest-api/requests/cluster/auditing-db-conns#put-cluster-audit-db-conns" >}}) cluster request: +To configure the audit destination using the REST API, use an [update database auditing](/content/operate/rs/references/rest-api/requests/cluster/auditing-db-conns.md#put-cluster-audit-db-conns) cluster request: ```sh PUT https://:/v1/cluster/auditing/db_conns @@ -149,15 +149,14 @@ After you configure the audit destination for your cluster, you can enable comma You can filter by usernames, source IP addresses, or both to manage data volume and avoid capturing irrelevant traffic. If both filters are configured, only requests matching both criteria are audited. -{{}} -Filter changes affect new client connections only. Existing connections continue to be audited based on the filters that were active when the connection was established. -{{}} +> [!NOTE] +> Filter changes affect new client connections only. Existing connections continue to be audited based on the filters that were active when the connection was established. {{< multitabs id="enable-command-connection-auditing" tab1="REST API" tab2="rladmin" >}} -To enable command and connection auditing and configure filters, use an [update database configuration]({{< relref "/operate/rs/references/rest-api/requests/bdbs#put-bdbs" >}}) REST API request: +To enable command and connection auditing and configure filters, use an [update database configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) REST API request: ``` PUT https://:/v1/bdbs/ @@ -275,7 +274,7 @@ After you configure the audit destination for your cluster, you can enable conne tab1="REST API" tab2="rladmin" >}} -To enable connection auditing only using the REST API, use an [update database configuration]({{< relref "/operate/rs/references/rest-api/requests/bdbs#put-bdbs" >}}) request: +To enable connection auditing only using the REST API, use an [update database configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) request: ``` PUT https://:/v1/bdbs/ @@ -296,9 +295,8 @@ rladmin tune db db: audit_settings audit_mode connection {{< /multitabs >}} -{{}} -The legacy `db_conns_auditing` field enables connection auditing only; it does not enable command (CRUD) auditing. To audit commands, set `audit_settings.audit_mode` to `connection_and_crud`. If both are set, `audit_settings.audit_mode` takes precedence. -{{}} +> [!NOTE] +> The legacy `db_conns_auditing` field enables connection auditing only; it does not enable command (CRUD) auditing. To audit commands, set `audit_settings.audit_mode` to `connection_and_crud`. If both are set, `audit_settings.audit_mode` takes precedence. ## Set policy defaults for new databases @@ -308,7 +306,7 @@ To audit connections for new databases by default, use one of the following meth tab1="REST API" tab2="rladmin" >}} -To enable auditing connections for new databases by default using the REST API, use an [update cluster policy]({{< relref "/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy" >}}) request: +To enable auditing connections for new databases by default using the REST API, use an [update cluster policy](/content/operate/rs/references/rest-api/requests/cluster/policy.md#put-cluster-policy) request: ``` PUT /v1/cluster/policy @@ -502,9 +500,8 @@ Here's what's reported when a database connection is closed: All audit records follow a unified JSON structure that is backward compatible with the existing authentication request format used for connection auditing. -{{}} -Command audit records never include the payload value associated with a key. Only the key name is recorded. -{{}} +> [!NOTE] +> Command audit records never include the payload value associated with a key. Only the key name is recorded. ### Record types @@ -622,7 +619,7 @@ Audit delivery is best effort—database operations are never delayed or rejecte ### Available metrics -You can use the following metrics exported by Redis Software to monitor your database auditing pipeline. For more information about monitoring Redis Software, see the [monitoring v2 documentation]({{}}). +You can use the following metrics exported by Redis Software to monitor your database auditing pipeline. For more information about monitoring Redis Software, see the [monitoring v2 documentation](/content/operate/rs/monitoring/metrics_stream_engine/_index.md). | Metric | Description | |--------|---| diff --git a/content/operate/rs/security/certificates/_index.md b/content/operate/rs/security/certificates/_index.md index 5eab40c9fa..73af33b805 100644 --- a/content/operate/rs/security/certificates/_index.md +++ b/content/operate/rs/security/certificates/_index.md @@ -21,19 +21,19 @@ Here's the list of supported certificates that create secure, encrypted connecti | Certificate name | Autogenerated | Description | |------------------|:---------------:|-------------| -| `api` | ✅ | Encrypts [REST API]({{< relref "/operate/rs/references/rest-api/" >}}) requests and responses. | -| `ccs_internode_encryption` | ✅ | Control plane [internode encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}). Encrypts internal traffic for cluster management. | +| `api` | ✅ | Encrypts [REST API](/content/operate/rs/references/rest-api/_index.md) requests and responses. | +| `ccs_internode_encryption` | ✅ | Control plane [internode encryption](/content/operate/rs/security/encryption/internode-encryption.md). Encrypts internal traffic for cluster management. | | `cm` | ✅ | Secures connections to the Redis Software Cluster Manager UI. | -| `data_internode_encryption` | ✅ | Data plane [internode encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}). Encrypts internal data traffic between shards and the data management controller (DMC). | +| `data_internode_encryption` | ✅ | Data plane [internode encryption](/content/operate/rs/security/encryption/internode-encryption.md). Encrypts internal data traffic between shards and the data management controller (DMC). | | `ldap_client` | :x: | Secures connections between LDAP clients and LDAP servers. | -| `metrics_exporter` | ✅ | Sends Redis Software metrics to external [monitoring tools]({{< relref "/operate/rs/monitoring/" >}}) over a secure connection. | +| `metrics_exporter` | ✅ | Sends Redis Software metrics to external [monitoring tools](/content/operate/rs/monitoring/_index.md) over a secure connection. | | `mtls_trusted_ca` | :x: | Required to enable certificate-based authentication for secure, passwordless access to the REST API. | | `proxy` | ✅ | Creates secure, encrypted connections between clients and databases. | -| `sso_issuer` | :x: | Identity provider certificate for [single sign-on (SSO)]({{< relref "/operate/rs/security/access-control/saml-sso" >}}). | -| `sso_service` | :x: | Service provider certificate for [single sign-on (SSO)]({{< relref "/operate/rs/security/access-control/saml-sso" >}}). | -| `syncer` | ✅ | For [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) or [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of/" >}}) databases, encrypts data during the synchronization of participating clusters. | +| `sso_issuer` | :x: | Identity provider certificate for [single sign-on (SSO)](/content/operate/rs/security/access-control/saml-sso.md). | +| `sso_service` | :x: | Service provider certificate for [single sign-on (SSO)](/content/operate/rs/security/access-control/saml-sso.md). | +| `syncer` | ✅ | For [Active-Active](/content/operate/rs/databases/active-active/_index.md) or [Replica Of](/content/operate/rs/databases/import-export/replica-of/_index.md) databases, encrypts data during the synchronization of participating clusters. | -Certificates that are not autogenerated are optional unless you want to use certain features. For example, you must provide your own `ldap_client` certificate to enable [LDAP authentication]({{}}), an `mtls_trusted_ca` certificate to enable certificate-based authentication, or `sso_issuer` and `sso_service` certificates for [single sign-on (SSO)]({{}}). +Certificates that are not autogenerated are optional unless you want to use certain features. For example, you must provide your own `ldap_client` certificate to enable [LDAP authentication](/content/operate/rs/security/access-control/ldap/_index.md), an `mtls_trusted_ca` certificate to enable certificate-based authentication, or `sso_issuer` and `sso_service` certificates for [single sign-on (SSO)](/content/operate/rs/security/access-control/saml-sso.md). ## Accept self-signed certificates to access the Cluster Manager UI diff --git a/content/operate/rs/security/certificates/certificate-based-authentication.md b/content/operate/rs/security/certificates/certificate-based-authentication.md index 281b824940..e89aa0d22f 100644 --- a/content/operate/rs/security/certificates/certificate-based-authentication.md +++ b/content/operate/rs/security/certificates/certificate-based-authentication.md @@ -10,7 +10,7 @@ linkTitle: Certificate-based authentication weight: 70 --- -You can set up certificate-based authentication for specific users to enable secure, passwordless access to the Redis Software [REST API]({{}}) and databases. +You can set up certificate-based authentication for specific users to enable secure, passwordless access to the Redis Software [REST API](/content/operate/rs/references/rest-api/_index.md) and databases. ## Certificate-based authentication for the REST API @@ -18,7 +18,7 @@ You can set up certificate-based authentication for specific users to enable sec To set up certificate-based authentication: -1. Add a trusted CA certificate `mtls_trusted_ca` to the cluster using an [update cluster certificates]({{}}) request: +1. Add a trusted CA certificate `mtls_trusted_ca` to the cluster using an [update cluster certificates](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md) request: {{< multitabs id="add-mtls_trusted_ca-cert" tab1="Redis Software v7.22.2 and later" @@ -52,7 +52,7 @@ PUT /v1/cluster/update_cert {{< /multitabs >}} -1. [Update cluster settings]({{}}) with mutual TLS (mTLS) configuration using one of the following options: +1. [Update cluster settings](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) with mutual TLS (mTLS) configuration using one of the following options: {{< multitabs id="enable-mTLS" tab1="Without subject validation" @@ -156,7 +156,7 @@ PUT /v1/cluster {{< /multitabs >}} -1. When you [create new users]({{}}), include `"auth_method": "certificate"` and `certificate_subject_line` in the request body: +1. When you [create new users](/content/operate/rs/references/rest-api/requests/users/_index.md#post-user), include `"auth_method": "certificate"` and `certificate_subject_line` in the request body: ```sh POST /v1/users @@ -168,25 +168,25 @@ PUT /v1/cluster Replace the placeholder values `<>` with your client certificate's subject values. - {{}} -The `certificate_subject_line` must: - -- Follow [RFC 2253](https://www.rfc-editor.org/rfc/rfc2253) format. - -- List the attributes in reverse order, starting with the Common Name (`CN`). - -- Not contain spaces after the commas that separate attributes. - -- Exactly match the certificate's RFC 2253 subject. - -- Contain only one Organizational Unit (`OU`) value. - {{}} + > [!NOTE] + > The `certificate_subject_line` must: + > + > - Follow [RFC 2253](https://www.rfc-editor.org/rfc/rfc2253) format. + > + > - List the attributes in reverse order, starting with the Common Name (`CN`). + > + > - Not contain spaces after the commas that separate attributes. + > + > - Exactly match the certificate's RFC 2253 subject. + > + > - Contain only one Organizational Unit (`OU`) value. + > ### Authenticate REST API requests To use the REST API with certificate-based authentication, you must provide a client certificate, signed by the trusted CA `mtls_trusted_ca`, and a private key. -The following example uses [cURL](https://curl.se/) to send a [REST API request]({{}}): +The following example uses [cURL](https://curl.se/) to send a [REST API request](/content/operate/rs/references/rest-api/requests/_index.md): ```sh curl --request --url https://:9443// --cert client.pem --key client.key @@ -217,13 +217,13 @@ The same three values take different formats depending on the interface: | Interface | Format | |-----------|--------| | Bootstrap API `credentials` | PEM strings | -| [`rladmin cluster join`]({{}}) | File paths | +| [`rladmin cluster join`](/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md) | File paths | | Active-Active REST API `certificate_auth` | PEM strings | -| [`crdb-cli`]({{}}) | PEM strings | +| [`crdb-cli`](/content/operate/rs/references/cli-utilities/crdb-cli/_index.md) | PEM strings | ### Join a node to the cluster -To join a node with certificate credentials, include `client_cert`, `client_key`, and `trusted_ca` in the `credentials` object of a [bootstrap]({{}}) request. These fields take PEM strings: +To join a node with certificate credentials, include `client_cert`, `client_key`, and `trusted_ca` in the `credentials` object of a [bootstrap](/content/operate/rs/references/rest-api/requests/bootstrap/_index.md) request. These fields take PEM strings: ```sh POST /v1/bootstrap/join_cluster @@ -240,7 +240,7 @@ POST /v1/bootstrap/join_cluster } ``` -[`rladmin cluster join`]({{}}) accepts the same three values as file paths, not PEM strings: +[`rladmin cluster join`](/content/operate/rs/references/cli-utilities/rladmin/cluster/join.md) accepts the same three values as file paths, not PEM strings: ```sh rladmin cluster join nodes \ @@ -290,7 +290,7 @@ POST /v1/crdbs } ``` -To create an Active-Active database with certificate credentials from the command line, use [`crdb-cli crdb create`]({{}}). The `--instance` option takes PEM strings: +To create an Active-Active database with certificate credentials from the command line, use [`crdb-cli crdb create`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/create.md). The `--instance` option takes PEM strings: ```sh crdb-cli crdb create \ @@ -299,7 +299,7 @@ crdb-cli crdb create \ --instance "fqdn=cluster2.local,client_cert=,client_key=,trusted_ca=" ``` -To add a participating cluster to an existing Active-Active database, use [`crdb-cli crdb add-instance`]({{}}). Its `--instance` option accepts the same fields as `crdb-cli crdb create`: +To add a participating cluster to an existing Active-Active database, use [`crdb-cli crdb add-instance`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/add-instance.md). Its `--instance` option accepts the same fields as `crdb-cli crdb create`: ```sh crdb-cli crdb add-instance \ @@ -307,7 +307,7 @@ crdb-cli crdb add-instance \ --instance "fqdn=cluster3.local,client_cert=,client_key=,trusted_ca=" ``` -To switch an existing participating cluster from a username and password to certificate credentials, use [`crdb-cli crdb update`]({{}}) with the instance's `id`: +To switch an existing participating cluster from a username and password to certificate credentials, use [`crdb-cli crdb update`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md) with the instance's `id`: ```sh crdb-cli crdb update \ @@ -321,9 +321,9 @@ crdb-cli crdb update \ To set up certificate-based authentication for databases: -1. Enable mutual TLS for the relevant databases. See [Enable TLS]({{}}) for detailed instructions. +1. Enable mutual TLS for the relevant databases. See [Enable TLS](/content/operate/rs/security/encryption/tls/enable-tls.md) for detailed instructions. -1. When you [create new users]({{}}), include `"auth_method": "certificate"` and `certificate_subject_line` in the request body: +1. When you [create new users](/content/operate/rs/references/rest-api/requests/users/_index.md#post-user), include `"auth_method": "certificate"` and `certificate_subject_line` in the request body: ```sh POST /v1/users @@ -335,25 +335,25 @@ To set up certificate-based authentication for databases: Replace the placeholder values `<>` with your client certificate's subject values. - {{}} -The `certificate_subject_line` must: - -- Follow [RFC 2253](https://www.rfc-editor.org/rfc/rfc2253) format. - -- List the attributes in reverse order, starting with the Common Name (`CN`). - -- Not contain spaces after the commas that separate attributes. - -- Exactly match the certificate's RFC 2253 subject. - -- Contain only one Organizational Unit (`OU`) value. - {{}} + > [!NOTE] + > The `certificate_subject_line` must: + > + > - Follow [RFC 2253](https://www.rfc-editor.org/rfc/rfc2253) format. + > + > - List the attributes in reverse order, starting with the Common Name (`CN`). + > + > - Not contain spaces after the commas that separate attributes. + > + > - Exactly match the certificate's RFC 2253 subject. + > + > - Contain only one Organizational Unit (`OU`) value. + > ### Authenticate database connections -To connect to a database with certificate-based authentication, you must provide a client certificate, signed by a trusted CA, and a private key. The client certificate must either be one you previously added to the database to [enable mutual TLS]({{}}) (`authentication_ssl_client_certs` in the REST API), or be signed by one of these certificates. +To connect to a database with certificate-based authentication, you must provide a client certificate, signed by a trusted CA, and a private key. The client certificate must either be one you previously added to the database to [enable mutual TLS](/content/operate/rs/security/encryption/tls/enable-tls.md#enable-mutual-tls) (`authentication_ssl_client_certs` in the REST API), or be signed by one of these certificates. -The following example shows how to connect to a Redis database with [`redis-cli`]({{}}): +The following example shows how to connect to a Redis database with [`redis-cli`](/content/operate/rs/references/cli-utilities/redis-cli/_index.md): ```sh redis-cli -h -p --tls --cacert .pem --cert redis_user.crt --key redis_user_private.key diff --git a/content/operate/rs/security/certificates/create-certificates.md b/content/operate/rs/security/certificates/create-certificates.md index 7516746887..6598ec4adf 100644 --- a/content/operate/rs/security/certificates/create-certificates.md +++ b/content/operate/rs/security/certificates/create-certificates.md @@ -16,7 +16,7 @@ You can renew these certificates by replacing them with new self-signed certific ## Renew self-signed certificates -As of [v6.2.18-70]({{< relref "/operate/rs/release-notes/rs-6-2-18-releases/rs-6-2-18-70" >}}), Redis Software includes a script to generate self-signed certificates. +As of [v6.2.18-70](/content/operate/rs/release-notes/rs-6-2-18-releases/rs-6-2-18-70.md), Redis Software includes a script to generate self-signed certificates. By default, the `generate_self_signed_certs.sh` script is located in `/opt/redislabs/utils/`. @@ -104,7 +104,7 @@ The following values are supported for the _\_ parameter: | `proxy` | The database endpoint | | `syncer` | The synchronization process | -You can also use the REST API. To learn more, see [Update certificates]({{< relref "/operate/rs/security/certificates/updating-certificates#how-to-update-certificates" >}}). +You can also use the REST API. To learn more, see [Update certificates](/content/operate/rs/security/certificates/updating-certificates.md#how-to-update-certificates). ## Create CA-signed certificates @@ -120,9 +120,9 @@ For best results, use the following guidelines to create the certificates. - TLS Web Client Authentication (OID: 1.3.6.1.5.5.7.3.2) - {{}} -Using certificate templates that only include Server Authentication will cause SSL and TLS errors. - {{}} + > [!WARNING] + > Using certificate templates that only include Server Authentication will cause SSL and TLS errors. + > - Include the full certificate chain when creating certificate .PEM files. List certificates in order from leaf to root. Some deployments may not require the root CA in the certificate file. @@ -166,9 +166,9 @@ Using certificate templates that only include Server Authentication will cause S - Use SHA-256 or SHA-512 for the signature algorithm. - {{}} -SHA-1 is deprecated and may be blocked by some operating systems. - {{}} + > [!NOTE] + > SHA-1 is deprecated and may be blocked by some operating systems. + > - The minimum RSA key size is 2048 bits. 4096 bits is recommended for enhanced security. @@ -268,9 +268,9 @@ SHA-1 is deprecated and may be blocked by some operating systems. -extfile redis-cert.cnf ``` - {{}} -Do not use self-signed certificates in production. - {{}} + > [!WARNING] + > Do not use self-signed certificates in production. + > #### Create a certificate chain file @@ -527,9 +527,9 @@ Before you upload certificates to Redis Software, validate that they meet all re Expected output: `sha256WithRSAEncryption` or `sha512WithRSAEncryption`. - {{}} -Avoid `sha1WithRSAEncryption` because it is deprecated and might be blocked. - {{}} + > [!NOTE] + > Avoid `sha1WithRSAEncryption` because it is deprecated and might be blocked. + > 1. Validate the public key size: @@ -579,7 +579,7 @@ After creating and validating your certificates, install them on the Redis Softw $ chown redislabs:redislabs redis-cert-chain.pem ``` -1. Replace the existing certificates with the new certificates using [`rladmin cluster certificate`]({{}}): +1. Replace the existing certificates with the new certificates using [`rladmin cluster certificate`](/content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md): ```bash rladmin cluster certificate set \ diff --git a/content/operate/rs/security/certificates/monitor-certificates.md b/content/operate/rs/security/certificates/monitor-certificates.md index cd7c78b0d1..68f45cd117 100644 --- a/content/operate/rs/security/certificates/monitor-certificates.md +++ b/content/operate/rs/security/certificates/monitor-certificates.md @@ -12,11 +12,11 @@ weight: 10 Redis Software exposes the expiration time in seconds of each certificate on each node. You can use Prometheus to monitor these certificates. -To learn how to monitor Redis Software metrics using Prometheus, see [Monitoring with metrics and alerts]({{}}) and the [Prometheus integration quick start]({{< relref "/integrate/prometheus-with-redis-enterprise/" >}}). +To learn how to monitor Redis Software metrics using Prometheus, see [Monitoring with metrics and alerts](/content/operate/rs/monitoring/_index.md) and the [Prometheus integration quick start](/content/integrate/prometheus-with-redis-enterprise/_index.md). ## V1 metrics -The [v1 metrics]({{}}) endpoint (`https://:8070/`) uses `node_cert_expiration_seconds`. +The [v1 metrics](/content/operate/rs/monitoring/v1_monitoring.md) endpoint (`https://:8070/`) uses `node_cert_expiration_seconds`. ### Certificate expiration in seconds {#v1-cert-expire-seconds} @@ -28,7 +28,7 @@ node_cert_expiration_seconds{cluster="mycluster.local",logical_name="metrics_exp node_cert_expiration_seconds{cluster="mycluster.local",logical_name="syncer",node="1",path="/etc/opt/redislabs/syncer_cert.pem"} 31104000.0 ``` -The following certificates relate to [internode communication TLS encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}) and are automatically rotated by Redis Software: +The following certificates relate to [internode communication TLS encryption](/content/operate/rs/security/encryption/internode-encryption.md) and are automatically rotated by Redis Software: ```sh node_cert_expiration_seconds{cluster="mycluster.local",logical_name="ccs_internode_encryption",node="1",path="/etc/opt/redislabs/ccs_internode_encryption_cert.pem"} 2592000.0 @@ -39,7 +39,7 @@ node_cert_expiration_seconds{cluster="mycluster.local",logical_name="gossip_ca_s ## V2 metrics -The [v2 metrics]({{}}) endpoint (`https://:8070/v2`) uses `node_cert_expires_in_seconds`. +The [v2 metrics](/content/operate/rs/monitoring/metrics_stream_engine/_index.md) endpoint (`https://:8070/v2`) uses `node_cert_expires_in_seconds`. ### Certificate expiration in seconds {#v2-cert-expire-seconds} @@ -51,7 +51,7 @@ node_cert_expires_in_seconds{cluster="mycluster.local",logical_name="metrics_exp node_cert_expires_in_seconds{cluster="mycluster.local",logical_name="syncer",node="1",path="/etc/opt/redislabs/syncer_cert.pem"} 31104000.0 ``` -The following certificates relate to [internode communication TLS encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}) and are automatically rotated by Redis Software: +The following certificates relate to [internode communication TLS encryption](/content/operate/rs/security/encryption/internode-encryption.md) and are automatically rotated by Redis Software: ```sh node_cert_expires_in_seconds{cluster="mycluster.local",logical_name="ccs_internode_encryption",node="1",path="/etc/opt/redislabs/ccs_internode_encryption_cert.pem"} 2592000.0 @@ -68,7 +68,7 @@ max by(filename) ( ) / 86400 ``` -The following certificates relate to [internode communication TLS encryption]({{< relref "/operate/rs/security/encryption/internode-encryption" >}}) and are automatically rotated by Redis Software: +The following certificates relate to [internode communication TLS encryption](/content/operate/rs/security/encryption/internode-encryption.md) and are automatically rotated by Redis Software: ```sh max by(filename) ( diff --git a/content/operate/rs/security/certificates/ocsp-stapling.md b/content/operate/rs/security/certificates/ocsp-stapling.md index 6ede3edeb4..45f27c39fb 100644 --- a/content/operate/rs/security/certificates/ocsp-stapling.md +++ b/content/operate/rs/security/certificates/ocsp-stapling.md @@ -58,11 +58,11 @@ To set up OCSP stapling with the Redis Software Cluster Manager UI: ### REST API method -To set up OCSP stapling with the [REST API]({{< relref "/operate/rs/references/rest-api" >}}): +To set up OCSP stapling with the [REST API](/content/operate/rs/references/rest-api/_index.md): -1. Use the REST API to [replace the proxy certificate]({{< relref "/operate/rs/security/certificates/updating-certificates#use-the-rest-api" >}}) with a certificate signed by your third-party CA. +1. Use the REST API to [replace the proxy certificate](/content/operate/rs/security/certificates/updating-certificates.md#use-the-rest-api) with a certificate signed by your third-party CA. -1. To configure and enable OCSP, send a [`PUT` request to the `/v1/ocsp`]({{< relref "/operate/rs/references/rest-api/requests/ocsp#put-ocsp" >}}) endpoint and include an [OCSP JSON object]({{< relref "/operate/rs/references/rest-api/objects/ocsp" >}}) in the request body: +1. To configure and enable OCSP, send a [`PUT` request to the `/v1/ocsp`](/content/operate/rs/references/rest-api/requests/ocsp/_index.md#put-ocsp) endpoint and include an [OCSP JSON object](/content/operate/rs/references/rest-api/objects/ocsp.md) in the request body: ```json { @@ -76,11 +76,11 @@ To set up OCSP stapling with the [REST API]({{< relref "/operate/rs/references/r ### `rladmin` method -To set up OCSP stapling with the [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command-line utility: +To set up OCSP stapling with the [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command-line utility: -1. Use [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/certificate" >}}) to [replace the proxy certificate]({{< relref "/operate/rs/security/certificates/updating-certificates#use-the-cli" >}}) with a certificate signed by your third-party CA. +1. Use [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md) to [replace the proxy certificate](/content/operate/rs/security/certificates/updating-certificates.md#use-the-cli) with a certificate signed by your third-party CA. -1. Update the cluster's OCSP settings with the [`rladmin cluster ocsp config`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/ocsp#ocsp-config" >}}) command if you don't want to use their default values. +1. Update the cluster's OCSP settings with the [`rladmin cluster ocsp config`](/content/operate/rs/references/cli-utilities/rladmin/cluster/ocsp.md#ocsp-config) command if you don't want to use their default values. For example: diff --git a/content/operate/rs/security/certificates/updating-certificates.md b/content/operate/rs/security/certificates/updating-certificates.md index 66ff0b5304..df7d574120 100644 --- a/content/operate/rs/security/certificates/updating-certificates.md +++ b/content/operate/rs/security/certificates/updating-certificates.md @@ -10,17 +10,16 @@ title: Update certificates weight: 20 --- -{{}} -When you update the certificates, the new certificate replaces the same certificates on all nodes in the cluster. -{{}} +> [!WARNING] +> When you update the certificates, the new certificate replaces the same certificates on all nodes in the cluster. ## Prerequisites -You need to create new certificates before you can update them in the cluster. To create replacement certificates, see [Renew self-signed certificates]({{}}) or [Create CA-signed certificates]({{}}) for detailed instructions. +You need to create new certificates before you can update them in the cluster. To create replacement certificates, see [Renew self-signed certificates](/content/operate/rs/security/certificates/create-certificates.md#renew-self-signed-certificates) or [Create CA-signed certificates](/content/operate/rs/security/certificates/create-certificates.md#create-ca-signed-certificates) for detailed instructions. ## How to update certificates -You can use the [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command-line interface (CLI) or the [REST API]({{< relref "/operate/rs/references/rest-api" >}}) to update certificates. The Cluster Manager UI lets you update proxy, syncer, and internode encryption certificates on the **Cluster > Security > Certificates** screen. +You can use the [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command-line interface (CLI) or the [REST API](/content/operate/rs/references/rest-api/_index.md) to update certificates. The Cluster Manager UI lets you update proxy, syncer, and internode encryption certificates on the **Cluster > Security > Certificates** screen. {{< multitabs id="update-certs" tab1="Cluster Manager UI" @@ -50,7 +49,7 @@ To replace proxy, syncer, or internode encryption certificates using the Cluster -tab-sep- -To replace certificates with the `rladmin` CLI, run the [`cluster certificate set`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/certificate" >}}) command: +To replace certificates with the `rladmin` CLI, run the [`cluster certificate set`](/content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md) command: ```sh rladmin cluster certificate set certificate_file .pem key_file .pem @@ -58,7 +57,7 @@ To replace certificates with the `rladmin` CLI, run the [`cluster certificate se Replace the following variables with your own values: -- `` - The name of the certificate you want to replace. See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of valid certificate names. +- `` - The name of the certificate you want to replace. See the [certificates table](/content/operate/rs/security/certificates/_index.md) for the list of valid certificate names. - `` - The name of your certificate file - `` - The name of your key file @@ -70,7 +69,7 @@ rladmin cluster certificate set cm certificate_file cluster.pem key_file key.pem -tab-sep- -To replace a certificate using the REST API, use an [update cluster certificates]({{}}) request. +To replace a certificate using the REST API, use an [update cluster certificates](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md) request. For Redis Software versions 7.22.2 and later, use: @@ -96,14 +95,13 @@ PUT https://:/v1/cluster/update_cert Replace the following variables with your own values: -- `` - The name of the certificate to replace. See the [certificates table]({{< relref "/operate/rs/security/certificates" >}}) for the list of valid certificate names. +- `` - The name of the certificate to replace. See the [certificates table](/content/operate/rs/security/certificates/_index.md) for the list of valid certificate names. - `` - The contents of the \*\_key.pem file - {{< tip >}} - - The key file contains `\n` end of line characters (EOL) that you cannot paste into the API call. - You can use `sed -z 's/\n/\\\n/g'` to escape the EOL characters. - {{< /tip >}} + > [!TIP] + > The key file contains `\n` end of line characters (EOL) that you cannot paste into the API call. + > You can use `sed -z 's/\n/\\\n/g'` to escape the EOL characters. + > - `` - The contents of the \*\_cert.pem file @@ -113,9 +111,8 @@ New proxy and syncer certificates are used the next time clients connect to the When you add a new node to the cluster, the certificates are automatically copied to the new node. -{{}} -Don't manually overwrite the files located in `/etc/opt/redislabs`. Instead, upload new certificates to a temporary location on one of the cluster nodes, such as the `/tmp` directory. -{{}} +> [!NOTE] +> Don't manually overwrite the files located in `/etc/opt/redislabs`. Instead, upload new certificates to a temporary location on one of the cluster nodes, such as the `/tmp` directory. ## Replica Of database certificates @@ -127,11 +124,10 @@ To update the proxy certificate on clusters running Replica Of databases: 1. Use the Cluster Manager UI, `rladmin`, or the REST API to update the proxy certificate on the source database cluster. -1. From the Cluster Manager UI, update the destination database (_replica_) configuration with the [new certificate]({{< relref "/operate/rs/databases/import-export/replica-of/create#encrypt-replica-database-traffic" >}}). +1. From the Cluster Manager UI, update the destination database (_replica_) configuration with the [new certificate](/content/operate/rs/databases/import-export/replica-of/create.md#encrypt-replica-database-traffic). -{{}} -- Perform step 2 as quickly as possible after performing step 1. Connections using the previous certificate are rejected after applying the new certificate. Until both steps are performed, recovery of the database sync cannot be established. -{{}} +> [!NOTE] +> - Perform step 2 as quickly as possible after performing step 1. Connections using the previous certificate are rejected after applying the new certificate. Until both steps are performed, recovery of the database sync cannot be established. ## Active-Active database certificates @@ -141,16 +137,15 @@ To update proxy certificate on clusters running Active-Active databases: 1. Use the Cluster Manager UI, `rladmin`, or the REST API to update proxy certificates on a single cluster, multiple clusters, or all participating clusters. -1. Use the [`crdb-cli`]({{< relref "/operate/rs/references/cli-utilities/crdb-cli" >}}) utility to update Active-Active database configuration from the command line. Run the following command once for each Active-Active database residing on the modified clusters: +1. Use the [`crdb-cli`](/content/operate/rs/references/cli-utilities/crdb-cli/_index.md) utility to update Active-Active database configuration from the command line. Run the following command once for each Active-Active database residing on the modified clusters: ```sh crdb-cli crdb update --crdb-guid --force ``` -{{}} -- Perform step 2 as quickly as possible after performing step 1. Connections using the previous certificate are rejected after applying the new certificate. Until both steps are performed, recovery of the database sync cannot be established.
-- Do not run any other `crdb-cli crdb update` operations between the two steps. -{{}} +> [!NOTE] +> - Perform step 2 as quickly as possible after performing step 1. Connections using the previous certificate are rejected after applying the new certificate. Until both steps are performed, recovery of the database sync cannot be established.
+> - Do not run any other `crdb-cli crdb update` operations between the two steps. ### Update syncer certificates {#update-aa-syncer-certs} @@ -158,16 +153,15 @@ To update your syncer certificate on clusters running Active-Active databases, f 1. Update your syncer certificate on one or more of the participating clusters using the Cluster Manager UI, `rladmin`, or the REST API. You can update a single cluster, multiple clusters, or all participating clusters. -1. Update the Active-Active database configuration from the command line with the [`crdb-cli`]({{< relref "/operate/rs/references/cli-utilities/crdb-cli" >}}) utility. Run this command once for each Active-Active database that resides on the modified clusters: +1. Update the Active-Active database configuration from the command line with the [`crdb-cli`](/content/operate/rs/references/cli-utilities/crdb-cli/_index.md) utility. Run this command once for each Active-Active database that resides on the modified clusters: ```sh crdb-cli crdb update --crdb-guid --force ``` -{{}} -- Run step 2 as quickly as possible after step 1. Between the two steps, new syncer connections that use the ‘old’ certificate will get rejected by the cluster that has been updated with the new certificate (in step 1).
-- Do not run any other `crdb-cli crdb update` operations between the two steps.
-{{}} +> [!NOTE] +> - Run step 2 as quickly as possible after step 1. Between the two steps, new syncer connections that use the ‘old’ certificate will get rejected by the cluster that has been updated with the new certificate (in step 1).
+> - Do not run any other `crdb-cli crdb update` operations between the two steps.
## Troubleshoot RHEL 8 crypto policy and certificate key size diff --git a/content/operate/rs/security/encryption/_index.md b/content/operate/rs/security/encryption/_index.md index ff27717cf4..ebc4641859 100644 --- a/content/operate/rs/security/encryption/_index.md +++ b/content/operate/rs/security/encryption/_index.md @@ -18,7 +18,7 @@ Redis Software uses encryption to secure communications between clusters, nodes, ### TLS -Redis Software uses [Transport Layer Security (TLS)]({{}}) to encrypt communications for the following: +Redis Software uses [Transport Layer Security (TLS)](/content/operate/rs/security/encryption/tls/_index.md) to encrypt communications for the following: - Cluster Manager UI @@ -28,23 +28,23 @@ Redis Software uses [Transport Layer Security (TLS)]({{}}) for the following: +You can also [enable TLS authentication](/content/operate/rs/security/encryption/tls/enable-tls.md) for the following: - Communication from clients or applications to your database -- Communication from your database to other clusters for replication using [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of/" >}}) +- Communication from your database to other clusters for replication using [Replica Of](/content/operate/rs/databases/import-export/replica-of/_index.md) -- Communication to and from your database to other clusters for [Active-Active]({{< relref "/operate/rs/databases/active-active/_index.md" >}}) synchronization +- Communication to and from your database to other clusters for [Active-Active](/content/operate/rs/databases/active-active/_index.md) synchronization ### Internode encryption -[Internode encryption]({{}}) uses TLS to encrypt data in transit between cluster nodes. +[Internode encryption](/content/operate/rs/security/encryption/internode-encryption.md) uses TLS to encrypt data in transit between cluster nodes. -By default, internode encryption is enabled for the control plane, which manages the cluster and databases. If you also want to encrypt replication and proxy communications between database shards on different nodes, [enable data internode encryption]({{< relref "/operate/rs/security/encryption/internode-encryption#enable-data-internode-encryption" >}}). +By default, internode encryption is enabled for the control plane, which manages the cluster and databases. If you also want to encrypt replication and proxy communications between database shards on different nodes, [enable data internode encryption](/content/operate/rs/security/encryption/internode-encryption.md#enable-data-internode-encryption). ### Require HTTPS for REST API endpoints -By default, the Redis Software API supports communication over HTTP and HTTPS. However, you can [turn off HTTP support]({{< relref "/operate/rs/references/rest-api/encryption" >}}) to ensure that API requests are encrypted. +By default, the Redis Software API supports communication over HTTP and HTTPS. However, you can [turn off HTTP support](/content/operate/rs/references/rest-api/encryption.md) to ensure that API requests are encrypted. ## Encrypt data at rest @@ -54,7 +54,7 @@ To encrypt data stored on disk, use file system-based encryption capabilities av ### Private key encryption -Enable PEM encryption to [encrypt all private keys]({{< relref "/operate/rs/security/encryption/pem-encryption" >}}) on disk. +Enable PEM encryption to [encrypt all private keys](/content/operate/rs/security/encryption/pem-encryption.md) on disk. ## Encrypt data in use diff --git a/content/operate/rs/security/encryption/internode-encryption.md b/content/operate/rs/security/encryption/internode-encryption.md index cb64e87c6a..2e9da2c620 100644 --- a/content/operate/rs/security/encryption/internode-encryption.md +++ b/content/operate/rs/security/encryption/internode-encryption.md @@ -41,7 +41,7 @@ To enable internode encryption for a database (also called _data internode encry - Use the Cluster Manager UI to enable the **Internode Encryption** setting from the database **Security** screen. -- Use the `rladmin` command-line utility to set the [data_internode_encryption]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-db" >}}) setting for the database: +- Use the `rladmin` command-line utility to set the [data_internode_encryption](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-db) setting for the database: ``` shell rladmin tune db data_internode_encryption enabled @@ -74,13 +74,13 @@ To enable internode encryption for new databases by default, use one of the foll 1. Select **Save**. -- [rladmin tune cluster]({{< relref "/operate/rs/references/cli-utilities/rladmin/tune#tune-cluster" >}}): +- [rladmin tune cluster](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-cluster): ```sh rladmin tune cluster data_internode_encryption enabled ``` -- [Update cluster policy]({{< relref "/operate/rs/references/rest-api/requests/cluster/policy#put-cluster-policy" >}}) REST API request: +- [Update cluster policy](/content/operate/rs/references/rest-api/requests/cluster/policy.md#put-cluster-policy) REST API request: ```sh PUT /v1/cluster/policy @@ -172,13 +172,13 @@ tab3="REST API" >}} -tab-sep- -To use the same certificate for data and control plane internode encryption, run the following [`rladmin cluster certificate`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/certificate#cluster-certificate-set-internal" >}}) command: +To use the same certificate for data and control plane internode encryption, run the following [`rladmin cluster certificate`](/content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md#cluster-certificate-set-internal) command: ```sh rladmin cluster certificate set internal dpine_certificate_file dpine_key_file cpine_certificate_file cpine_key_file ``` -To use separate certificates for data and control plane internode encryption, run the following [`rladmin cluster certificate`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/certificate#cluster-certificate-set-internal" >}}) command: +To use separate certificates for data and control plane internode encryption, run the following [`rladmin cluster certificate`](/content/operate/rs/references/cli-utilities/rladmin/cluster/certificate.md#cluster-certificate-set-internal) command: ```sh rladmin cluster certificate set internal dpine_certificate_file dpine_key_file cpine_certificate_file cpine_key_file @@ -186,7 +186,7 @@ rladmin cluster certificate set internal dpine_certificate_file }}) request: +To use the same certificate for data and control plane internode encryption, send a [`PUT /v1/cluster/certificates`](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md#put-cluster-certificates) request: ```sh PUT https://:/v1/cluster/certificates @@ -206,7 +206,7 @@ PUT https://:/v1/cluster/certificates } ``` -To use separate certificates for data and control plane internode encryption, send a [`PUT /v1/cluster/certificates`]({{< relref "/operate/rs/references/rest-api/requests/cluster/certificates#put-cluster-certificates" >}}) request: +To use separate certificates for data and control plane internode encryption, send a [`PUT /v1/cluster/certificates`](/content/operate/rs/references/rest-api/requests/cluster/certificates/_index.md#put-cluster-certificates) request: ```sh PUT https://:/v1/cluster/certificates @@ -233,7 +233,7 @@ PUT https://:/v1/cluster/certificates Customer-provided internode encryption certificates are not rotated automatically. To prevent possible issues with cluster and database unavailability caused by expired internode encryption certificates: -- You should monitor the certificates' expiration dates and [renew them]({{}}) before they expire. +- You should monitor the certificates' expiration dates and [renew them](/content/operate/rs/security/certificates/updating-certificates.md#how-to-update-certificates) before they expire. - In case you do not renew the customer-managed certificates before they expire, Redis Software automatically replaces them with self-signed certificates 5 days before expiration. You can upload new customer-provided certificates to replace these certificates anytime. diff --git a/content/operate/rs/security/encryption/pem-encryption.md b/content/operate/rs/security/encryption/pem-encryption.md index e0509d4c0f..d582af2aa3 100644 --- a/content/operate/rs/security/encryption/pem-encryption.md +++ b/content/operate/rs/security/encryption/pem-encryption.md @@ -17,16 +17,16 @@ When certificates are rotated, the encrypted private keys are also rotated. ## Enable PEM encryption -To enable PEM encryption and encrypt private keys on the disk, use [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) or the [REST API]({{< relref "/operate/rs/references/rest-api" >}}). +To enable PEM encryption and encrypt private keys on the disk, use [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) or the [REST API](/content/operate/rs/references/rest-api/_index.md). -- [`rladmin cluster config`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/config" >}}): +- [`rladmin cluster config`](/content/operate/rs/references/cli-utilities/rladmin/cluster/config.md): ```sh rladmin cluster config encrypt_pkeys enabled ``` -- [Update cluster settings]({{< relref "/operate/rs/references/rest-api/requests/cluster#put-cluster" >}}) REST API request: +- [Update cluster settings](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT /v1/cluster @@ -35,15 +35,15 @@ To enable PEM encryption and encrypt private keys on the disk, use [`rladmin`]({ ## Deactivate PEM encryption -To deactivate PEM encryption and decrypt private keys on the disk, use [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) or the [REST API]({{< relref "/operate/rs/references/rest-api" >}}). +To deactivate PEM encryption and decrypt private keys on the disk, use [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) or the [REST API](/content/operate/rs/references/rest-api/_index.md). -- [`rladmin cluster config`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/config" >}}): +- [`rladmin cluster config`](/content/operate/rs/references/cli-utilities/rladmin/cluster/config.md): ```sh rladmin cluster config encrypt_pkeys disabled ``` -- [Update cluster settings]({{< relref "/operate/rs/references/rest-api/requests/cluster#put-cluster" >}}) REST API request: +- [Update cluster settings](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster) REST API request: ```sh PUT /v1/cluster diff --git a/content/operate/rs/security/encryption/tls/_index.md b/content/operate/rs/security/encryption/tls/_index.md index 7d1e4b97fd..3496a4e270 100644 --- a/content/operate/rs/security/encryption/tls/_index.md +++ b/content/operate/rs/security/encryption/tls/_index.md @@ -12,17 +12,17 @@ weight: 10 --- [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security), a successor to SSL, ensures the privacy of data sent between applications and Redis databases. TLS also secures connections between Redis Software nodes. -You can [use TLS authentication]({{< relref "/operate/rs/security/encryption/tls/enable-tls" >}}) for the following types of communication: +You can [use TLS authentication](/content/operate/rs/security/encryption/tls/enable-tls.md) for the following types of communication: - Communication from clients (applications) to your database -- Communication from your database to other clusters for replication using [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of" >}}) -- Communication to and from your database to other clusters for synchronization using [Active-Active]({{< relref "/operate/rs/databases/active-active/" >}}) +- Communication from your database to other clusters for replication using [Replica Of](/content/operate/rs/databases/import-export/replica-of/_index.md) +- Communication to and from your database to other clusters for synchronization using [Active-Active](/content/operate/rs/databases/active-active/_index.md) ## Protocols and ciphers TLS protocols and ciphers define the overall suite of algorithms that clients are able to connect to the servers with. -You can change the [TLS protocols]({{< relref "/operate/rs/security/encryption/tls/tls-protocols" >}}) and [ciphers]({{< relref "/operate/rs/security/encryption/tls/ciphers" >}}) to improve the security of your Redis Software cluster and databases. The default settings are in line with industry best practices, but you can customize them to match the security policy of your organization. +You can change the [TLS protocols](/content/operate/rs/security/encryption/tls/tls-protocols.md) and [ciphers](/content/operate/rs/security/encryption/tls/ciphers.md) to improve the security of your Redis Software cluster and databases. The default settings are in line with industry best practices, but you can customize them to match the security policy of your organization. ## Troubleshooting diff --git a/content/operate/rs/security/encryption/tls/ciphers.md b/content/operate/rs/security/encryption/tls/ciphers.md index 4c2780945d..c5f8621f77 100644 --- a/content/operate/rs/security/encryption/tls/ciphers.md +++ b/content/operate/rs/security/encryption/tls/ciphers.md @@ -18,7 +18,7 @@ Ciphers are algorithms that help secure connections between clients and servers. |------------|--------------|-------------| | control_cipher_suites | ✅ Yes | Cipher list for TLS 1.2 communications for cluster administration (control plane) | | data_cipher_list | ✅ Yes | Cipher list for TLS 1.2 communications between applications and databases (data plane) | -| sentinel_cipher_suites | ✅ Yes | Cipher list for [discovery service]({{< relref "/operate/rs/databases/durability-ha/discovery-service" >}}) (Sentinel) TLS 1.2 communications | +| sentinel_cipher_suites | ✅ Yes | Cipher list for [discovery service](/content/operate/rs/databases/durability-ha/discovery-service.md) (Sentinel) TLS 1.2 communications | ## TLS 1.3 cipher suites @@ -26,26 +26,24 @@ Ciphers are algorithms that help secure connections between clients and servers. |------------|--------------|-------------| | control_cipher_suites_tls_1_3 | ❌ No | Cipher list for TLS 1.3 communications for cluster administration (control plane) | | data_cipher_suites_tls_1_3 | ✅ Yes | Cipher list for TLS 1.3 communications between applications and databases (data plane) | -| sentinel_cipher_suites_tls_1_3 | ❌ No | Cipher list for [discovery service]({{< relref "/operate/rs/databases/durability-ha/discovery-service" >}}) (Sentinel) TLS 1.3 communications | +| sentinel_cipher_suites_tls_1_3 | ❌ No | Cipher list for [discovery service](/content/operate/rs/databases/durability-ha/discovery-service.md) (Sentinel) TLS 1.3 communications | ## Configure cipher suites -You can configure ciphers with the [Cluster Manager UI](#edit-ciphers-ui), [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/config" >}}), or the [REST API]({{< relref "/operate/rs/references/rest-api/requests/cluster#put-cluster" >}}). +You can configure ciphers with the [Cluster Manager UI](#edit-ciphers-ui), [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/cluster/config.md), or the [REST API](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster). -{{}} -Configuring cipher suites overwrites existing ciphers rather than appending new ciphers to the list. -{{}} +> [!WARNING] +> Configuring cipher suites overwrites existing ciphers rather than appending new ciphers to the list. When you modify your cipher suites, make sure: - The configured TLS version matches the required cipher suites. - The certificates in use are properly signed to support the required cipher suites. -{{}} -- Redis Software doesn't support static [Diffie–Hellman (`DH`) key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) ciphers. - -- Support for Ephemeral Diffie–Hellman (ECDHE) key exchange ciphers depends on the operating system version and security policy. -{{}} +> [!NOTE] +> - Redis Software doesn't support static [Diffie–Hellman (`DH`) key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) ciphers. +> +> - Support for Ephemeral Diffie–Hellman (ECDHE) key exchange ciphers depends on the operating system version and security policy. ### Edit cipher suites in the UI {#edit-ciphers-ui} @@ -69,7 +67,7 @@ As of Redis Software version 6.0.12, control plane cipher suites can use the Bor #### Configure TLS 1.2 control plane cipher suites -To configure TLS 1.2 cipher suites for cluster communication, use the following [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command syntax: +To configure TLS 1.2 cipher suites for cluster communication, use the following [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command syntax: ```sh rladmin cluster config control_cipher_suites @@ -80,9 +78,8 @@ See the example below to configure cipher suites for the control plane: ```sh rladmin cluster config control_cipher_suites ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 ``` -{{}} -- The deprecated 3DES and RC4 cipher suites are no longer supported. -{{}} +> [!NOTE] +> - The deprecated 3DES and RC4 cipher suites are no longer supported. ### Data plane cipher suites {#data-plane-ciphers-tls-1-2} @@ -91,7 +88,7 @@ Data plane cipher suites use the OpenSSL library format in Redis Software versio #### Configure TLS 1.2 data plane cipher suites -To configure TLS 1.2 cipher suites for communications between applications and databases, use the following [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command syntax: +To configure TLS 1.2 cipher suites for communications between applications and databases, use the following [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command syntax: ```sh rladmin cluster config data_cipher_list @@ -102,13 +99,12 @@ See the example below to configure cipher suites for the data plane: ```sh rladmin cluster config data_cipher_list AES128-SHA:AES256-SHA ``` -{{}} -- The deprecated 3DES and RC4 cipher suites are no longer supported. -{{}} +> [!NOTE] +> - The deprecated 3DES and RC4 cipher suites are no longer supported. #### Configure TLS 1.3 data plane cipher suites -To configure TLS 1.3 cipher suites for communications between applications and databases, use the following [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command syntax: +To configure TLS 1.3 cipher suites for communications between applications and databases, use the following [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command syntax: ```sh rladmin cluster config data_cipher_suites_tls_1_3 @@ -122,11 +118,11 @@ rladmin cluster config data_cipher_suites_tls_1_3 TLS_AES_256_GCM_SHA384:TLS_CHA ### Discovery service cipher suites {#discovery-service-ciphers-tls-1-2} -Sentinel service cipher suites use the golang.org OpenSSL format for [discovery service]({{< relref "/operate/rs/databases/durability-ha/discovery-service" >}}) TLS connections in Redis Software version 6.0.20 or later. See their documentation for a list of [available configurations](https://golang.org/src/crypto/tls/cipher_suites.go). +Sentinel service cipher suites use the golang.org OpenSSL format for [discovery service](/content/operate/rs/databases/durability-ha/discovery-service.md) TLS connections in Redis Software version 6.0.20 or later. See their documentation for a list of [available configurations](https://golang.org/src/crypto/tls/cipher_suites.go). #### Configure TLS 1.2 discovery service cipher suites -To configure TLS 1.2 cipher suites for the discovery service cipher suites, use the following [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin" >}}) command syntax: +To configure TLS 1.2 cipher suites for the discovery service cipher suites, use the following [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/_index.md) command syntax: ```sh rladmin cluster config sentinel_cipher_suites diff --git a/content/operate/rs/security/encryption/tls/enable-tls.md b/content/operate/rs/security/encryption/tls/enable-tls.md index e0c4643abe..b3d8548e36 100644 --- a/content/operate/rs/security/encryption/tls/enable-tls.md +++ b/content/operate/rs/security/encryption/tls/enable-tls.md @@ -13,12 +13,11 @@ weight: 40 You can use TLS authentication for one or more of the following types of communication: - Communication from clients (applications) to your database -- Communication from your database to other clusters for replication using [Replica Of]({{< relref "/operate/rs/databases/import-export/replica-of/" >}}) -- Communication to and from your database to other clusters for synchronization using [Active-Active]({{< relref "/operate/rs/databases/active-active/_index.md" >}}) +- Communication from your database to other clusters for replication using [Replica Of](/content/operate/rs/databases/import-export/replica-of/_index.md) +- Communication to and from your database to other clusters for synchronization using [Active-Active](/content/operate/rs/databases/active-active/_index.md) -{{}} -When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. You must update TLS parameters in the client's connection configuration, then clients must close existing connections and reconnect to apply the change. -{{}} +> [!NOTE] +> When you enable or turn off TLS, the change applies to new connections but does not affect existing connections. You must update TLS parameters in the client's connection configuration, then clients must close existing connections and reconnect to apply the change. ## Enable TLS for client connections {#client} @@ -40,7 +39,7 @@ To enable TLS for client connections using the Cluster Manager UI: You can also enable TLS for client connections using the REST API. -To enable TLS for client connections during database creation, include `"tls_mode": "enabled"` when you [create a database]({{}}): +To enable TLS for client connections during database creation, include `"tls_mode": "enabled"` when you [create a database](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#post-bdbs-v1): ```sh POST https://:/v1/bdbs @@ -50,9 +49,9 @@ POST https://:/v1/bdbs } ``` -For additional database configuration fields, see the [BDB object]({{}}) reference. +For additional database configuration fields, see the [BDB object](/content/operate/rs/references/rest-api/objects/bdb/_index.md) reference. -To enable TLS for client connections after database creation, you can use an [update database configuration]({{}}) REST API request: +To enable TLS for client connections after database creation, you can use an [update database configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) REST API request: ```sh PUT https://:/v1/bdbs/ @@ -114,7 +113,7 @@ To enable mutual TLS using the Cluster Manager UI: An example that shows adding a certificate validation with multiple organizational units. - **Breaking change:** If you use the [REST API]({{< relref "/operate/rs/references/rest-api" >}}) instead of the Cluster Manager UI to configure additional certificate validations, note that `authorized_names` is deprecated as of Redis Software v6.4.2. Use `authorized_subjects` instead. See the [BDB object reference]({{< relref "/operate/rs/references/rest-api/objects/bdb" >}}) for more details. + **Breaking change:** If you use the [REST API](/content/operate/rs/references/rest-api/_index.md) instead of the Cluster Manager UI to configure additional certificate validations, note that `authorized_names` is deprecated as of Redis Software v6.4.2. Use `authorized_subjects` instead. See the [BDB object reference](/content/operate/rs/references/rest-api/objects/bdb/_index.md) for more details. 1. Select **Save**. @@ -122,7 +121,7 @@ To enable mutual TLS using the Cluster Manager UI: You can also enable mutual TLS using the REST API. -To enable mutual TLS during database creation, include the following fields when you [create a database]({{}}): +To enable mutual TLS during database creation, include the following fields when you [create a database](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#post-bdbs-v1): ```sh POST https://:/v1/bdbs @@ -145,9 +144,9 @@ POST https://:/v1/bdbs } ``` -For additional database configuration fields, see the [BDB object]({{}}) reference. +For additional database configuration fields, see the [BDB object](/content/operate/rs/references/rest-api/objects/bdb/_index.md) reference. -To enable mutual TLS after database creation, you can use an [update database configuration]({{}}) REST API request: +To enable mutual TLS after database creation, you can use an [update database configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) REST API request: ```sh PUT https://:/v1/bdbs/ @@ -173,7 +172,7 @@ PUT https://:/v1/bdbs/ ### Validate client certificate expiration -By default, Redis Software validates client certificate expiration dates. You can use [`rladmin tune db`]({{}}) to turn off this behavior. +By default, Redis Software validates client certificate expiration dates. You can use [`rladmin tune db`](/content/operate/rs/references/cli-utilities/rladmin/tune.md#tune-db) to turn off this behavior. ```sh rladmin tune db < db:id | name > mtls_allow_outdated_certs { enabled | disabled } @@ -181,7 +180,7 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs { enabled | disabled ### Connect over TLS -To connect to a Redis Software database over TLS using [`redis-cli`]({{}}): +To connect to a Redis Software database over TLS using [`redis-cli`](/content/operate/rs/references/cli-utilities/redis-cli/_index.md): 1. Download or copy the server (or proxy) certificate from the Cluster Manager UI (**Cluster > Security > Certificates > Server authentication**) or from a cluster node (`/etc/opt/redislabs/proxy_cert.pem`). @@ -202,15 +201,15 @@ To connect to a Redis Software database over TLS using [`redis-cli`]({{}}), or the [REST API]({{}}). +You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`](/content/operate/rs/references/cli-utilities/crdb-cli/_index.md), or the [REST API](/content/operate/rs/references/rest-api/_index.md). -If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{}}) or the [REST API]({{}}). +If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`](/content/operate/rs/references/cli-utilities/crdb-cli/_index.md) or the [REST API](/content/operate/rs/references/rest-api/_index.md). ### Enable TLS during database creation To enable TLS for Active-Active cluster connections using the Cluster Manager UI: -1. During [database creation]({{}}), expand the **TLS** configuration section. +1. During [database creation](/content/operate/rs/databases/active-active/create.md), expand the **TLS** configuration section. 1. Select **On** to enable TLS. @@ -218,7 +217,7 @@ To enable TLS for Active-Active cluster connections using the Cluster Manager UI 1. Click **Create**. -If you also want to require TLS for client connections during creation, you can use the [create an Active-Active database]({{< relref "/operate/rs/references/rest-api/requests/crdbs/#post-crdb" >}}) REST API request to create an Active-Active database with TLS enabled for client connections. +If you also want to require TLS for client connections during creation, you can use the [create an Active-Active database](/content/operate/rs/references/rest-api/requests/crdbs/_index.md#post-crdb) REST API request to create an Active-Active database with TLS enabled for client connections. You should configure the client certificates individually for each instance instead of using the default database configuration, even if the same certificate is used across all instances. This allows you to rotate the certificates independently for each instance and to avoid outages in case of certificate expiration. @@ -284,7 +283,7 @@ You can enable TLS for an existing Active-Active database using either `crdb-cli tab1="CLI" tab2="REST API" >}} -Run the following [`crdb-cli crdb update`]({{}}) command: +Run the following [`crdb-cli crdb update`](/content/operate/rs/references/cli-utilities/crdb-cli/crdb/update.md) command: ```sh crdb-cli crdb update --crdb-guid --encryption true @@ -294,7 +293,7 @@ Replace `` with your Active-Active database's globally unique identifier. -tab-sep- -You can use an [update database configuration]({{}}) request to enable TLS. +You can use an [update database configuration](/content/operate/rs/references/rest-api/requests/bdbs/_index.md#put-bdbs) request to enable TLS. To enable TLS for Active-Active database communications only: diff --git a/content/operate/rs/security/encryption/tls/tls-protocols.md b/content/operate/rs/security/encryption/tls/tls-protocols.md index 59c9382e77..45478d5345 100644 --- a/content/operate/rs/security/encryption/tls/tls-protocols.md +++ b/content/operate/rs/security/encryption/tls/tls-protocols.md @@ -18,23 +18,21 @@ The communications for which you can modify TLS protocols are: - Control plane - The TLS configuration for cluster administration. - Data plane - The TLS configuration for the communication between applications and databases. -- Discovery service (Sentinel) - The TLS configuration for the [discovery service]({{< relref "/operate/rs/databases/durability-ha/discovery-service.md" >}}). +- Discovery service (Sentinel) - The TLS configuration for the [discovery service](/content/operate/rs/databases/durability-ha/discovery-service.md). -You can configure TLS protocols with the [Cluster Manager UI](#edit-tls-ui), [`rladmin`]({{< relref "/operate/rs/references/cli-utilities/rladmin/cluster/config" >}}), or the [REST API]({{< relref "/operate/rs/references/rest-api/requests/cluster#put-cluster" >}}). +You can configure TLS protocols with the [Cluster Manager UI](#edit-tls-ui), [`rladmin`](/content/operate/rs/references/cli-utilities/rladmin/cluster/config.md), or the [REST API](/content/operate/rs/references/rest-api/requests/cluster/_index.md#put-cluster). -{{}} -- After you set the minimum TLS version, Redis Software does not accept communications with TLS versions older than the specified version. - -- If you set TLS 1.3 as the minimum TLS version, clients must support TLS 1.3 to connect to Redis Software. -{{}} +> [!WARNING] +> - After you set the minimum TLS version, Redis Software does not accept communications with TLS versions older than the specified version. +> +> - If you set TLS 1.3 as the minimum TLS version, clients must support TLS 1.3 to connect to Redis Software. TLS support depends on the operating system. You cannot enable support for protocols or versions that aren't supported by the operating system running Redis Software. In addition, updates to the operating system or to Redis Software can impact protocol and version support. If you have trouble enabling specific versions of TLS, verify that they're supported by your operating system and that they're configured correctly. -{{}} -TLSv1.2 is generally recommended as the minimum TLS version for encrypted communications. Check with your security team to confirm which TLS protocols meet your organization's policies. -{{}} +> [!NOTE] +> TLSv1.2 is generally recommended as the minimum TLS version for encrypted communications. Check with your security team to confirm which TLS protocols meet your organization's policies. ### Edit TLS settings in the UI {#edit-tls-ui} diff --git a/content/operate/rs/security/recommended-security-practices.md b/content/operate/rs/security/recommended-security-practices.md index 46de05827d..17fa83b894 100644 --- a/content/operate/rs/security/recommended-security-practices.md +++ b/content/operate/rs/security/recommended-security-practices.md @@ -21,9 +21,9 @@ When deploying Redis Software to production, we recommend the following practice If you are replacing your existing antivirus solution or installing/supporting Redis Software, make sure that the below paths are excluded: - {{< note >}} -For antivirus solutions that intercept processes, binary files may have to be excluded directly depending on the requirements of your anti-virus vendor. - {{< /note >}} + > [!NOTE] + > For antivirus solutions that intercept processes, binary files may have to be excluded directly depending on the requirements of your anti-virus vendor. + > | **Path** | **Description** | |------------|-----------------| @@ -33,7 +33,7 @@ For antivirus solutions that intercept processes, binary files may have to be ex | /opt/redislabs/lib | System library files | | /opt/redislabs/sbin | System binaries for tweaking provisioning | -- **Send logs to a remote logging server**: Redis Software is configured to send logs by default to syslog. To send these logs to a remote logging server, you must [configure syslog]({{}}) based on the requirements of the remote logging server vendor. Remote logging helps ensure that the logs are not deleted so that you can rotate the logs to prevent your server disk from filling up. +- **Send logs to a remote logging server**: Redis Software is configured to send logs by default to syslog. To send these logs to a remote logging server, you must [configure syslog](/content/operate/rs/clusters/logging/log-security.md) based on the requirements of the remote logging server vendor. Remote logging helps ensure that the logs are not deleted so that you can rotate the logs to prevent your server disk from filling up. - **Deploy clusters with an odd number of 3 or more nodes**: Redis is an available and partition-tolerant database. We recommend that Redis Software be deployed in a cluster of an odd number of 3 or more nodes so that you are able to successfully failover in the event of a failure. @@ -43,11 +43,11 @@ For antivirus solutions that intercept processes, binary files may have to be ex ## Cluster security -- **Control the level of access to your system**: Redis Software lets you decide which users can access the cluster, which users can access databases, and which users can access both. We recommend preventing database users from accessing the cluster. See [Access control]({{}}) for more information. +- **Control the level of access to your system**: Redis Software lets you decide which users can access the cluster, which users can access databases, and which users can access both. We recommend preventing database users from accessing the cluster. See [Access control](/content/operate/rs/security/access-control/_index.md) for more information. - **Enable LDAP authentication**: If your organization uses the Lightweight Directory Access Protocol (LDAP), we recommend enabling Redis Software support for role-based LDAP authentication. -- **Require HTTPS for API endpoints**: Redis Software comes with a REST API to help automate tasks. This API is available in both an encrypted and unencrypted endpoint for backward compatibility. You can [disable the unencrypted endpoint]({{}}) with no loss in functionality. +- **Require HTTPS for API endpoints**: Redis Software comes with a REST API to help automate tasks. This API is available in both an encrypted and unencrypted endpoint for backward compatibility. You can [disable the unencrypted endpoint](/content/operate/rs/references/rest-api/encryption.md#require-https-for-api-endpoints) with no loss in functionality. ## Database security @@ -55,12 +55,12 @@ Redis Software offers several database security controls to help protect your da - **Use strong Redis passwords**: A frequent recommendation in the security industry is to use strong passwords to authenticate users. This helps to prevent brute force password guessing attacks against your database. Its important to check that your password aligns with your organizations security policy. -- **Deactivate default user access**: Redis Software comes with a "default" user for backwards compatibility with applications designed with versions of Redis prior to Redis Software 6. The default user is turned on by default. This allows you to access the database without specifying a username and only using a shared secret. For applications designed to use access control lists, we recommend that you [deactivate default user access]({{}}). +- **Deactivate default user access**: Redis Software comes with a "default" user for backwards compatibility with applications designed with versions of Redis prior to Redis Software 6. The default user is turned on by default. This allows you to access the database without specifying a username and only using a shared secret. For applications designed to use access control lists, we recommend that you [deactivate default user access](/content/operate/rs/security/access-control/manage-users/default-user.md#deactivate-default-user). -- **Configure Transport Layer Security (TLS)**: Similar to the control plane, you can also [configure TLS protocols]({{}}) to help support your security and compliance needs. +- **Configure Transport Layer Security (TLS)**: Similar to the control plane, you can also [configure TLS protocols](/content/operate/rs/security/encryption/tls/tls-protocols.md) to help support your security and compliance needs. -- **Enable client certificate authentication**: To prevent unauthorized access to your data, Redis Software databases support the [TLS protocol]({{}}), which includes authentication and encryption. Client certificate authentication can be used to ensure only authorized hosts can access the database. +- **Enable client certificate authentication**: To prevent unauthorized access to your data, Redis Software databases support the [TLS protocol](/content/operate/rs/security/encryption/tls/_index.md#client-certificate-authentication), which includes authentication and encryption. Client certificate authentication can be used to ensure only authorized hosts can access the database. -- **Install trusted certificates**: Redis implements self-signed certificates for the database proxy and replication service, but many organizations prefer to [use their own certificates]({{}}). +- **Install trusted certificates**: Redis implements self-signed certificates for the database proxy and replication service, but many organizations prefer to [use their own certificates](/content/operate/rs/security/certificates/create-certificates.md). -- **Configure and verify database backups**: Implementing a disaster recovery strategy is an important part of data security. Redis Software supports [database backups to many destinations]({{}}). +- **Configure and verify database backups**: Implementing a disaster recovery strategy is an important part of data security. Redis Software supports [database backups to many destinations](/content/operate/rs/databases/import-export/schedule-backups.md).