How to secure Redis Keys? - redis

Question

Is there any way to secure redis keys, even the person who knows redis-server password that can not access or see redis keys.
I need this security because i am storing session in redis keys.
For each user there is unique key which is stored in redis as key.
If user knows keys then he can access any account.
Any suggestions.
Thanks.

Answer 1

You can create a hash key, e.g. md5, for each session id, and take the hash key as Redis key.
// set
session_id_md5 = md5(session_id)
redis.set(session_id_md5, value);
When you want to get session info from Redis, re-create the hash key with session id, and search Redis with the hash key
// get
session_id_md5 = md5(session_id);
redis.get(session_id_md5);

Answer 2

Redis isn't designed to be used the way you are using it so this isn't possible, you should move your authentication up a level to your application.

Answer 3

Redis doesn't provide any ACLs, so restricting access to KEYS command for certain clients isn't possible without some additional middleware. But if you want to just disable KEYS command, add following line to your redis config:
rename-command KEYS ""
You probably should also disable MONITOR and CONFIG commands:
rename-command CONFIG ""
rename-command MONITOR ""

Answer 4

Thanks to all of you for your suggestions
I conclude with the following.
I want to provide security among developers not end users. we have a team of few person who has access of redis server to start and stop service and other configuration, I want to restrict those users from accessing keys.
As Redis doesn't have ACLs so i think we can't do such things. Still Anybody have any other idea then they are most welcome :)