In Redis there is an authentication feature and also different databases are possible, but can these feature be combined in a secure way?
From MySQL I know that there is a user management with and multiple users can have multiple passwords and can have permissions for only one database.
For security reasons I'd like to have it similar in Redis, because currently I can use requirepass
, but I have to add it to every application, which wants to connect to redis anyway. (Is there at least a way to use multiple passwords for requirepass
?
And I can connect to one database with an application, but AFAIK this application could also just switch to another database. (Can I at least prevent this switch somehow?)
For performance reasons I want to avoid running multiple instances of redis in parallel.
I'll start at the end:
For performance reasons I want to avoid running multiple instances of redis in parallel.
Just the opposite in fact - since Redis is (mostly) single threaded, running multiple instances parallel is exactly how you get better server utilization and increased performance.
The Redis notion of databases (also known as shared databases or numbered databases) is different from than that of the SQL domain. Redis' databases are more like namespaces, and besides sharing the same thread they also share all the configuration - the authentication password included.
So the answer is no, you can't set a different password for each database. For more details on why you should prefer dedicated Redis databases refer to: https://redislabs.com/blog/benchmark-shared-vs-dedicated-redis-instances