At Amazon ElastiCache for Redis, we can enable in-transit encryption (TLS) while creating a Redis replication group. The engine version must be 3.2.6, 4.0.10 or later. This is the only requirement. But the fun fact is, it isn’t possible to access the Redis through redis-cli. To access the data in Redis, we have to use clients that work with Secure Socket Layer (SSL) or Transport Layer Security (TLS). But redis-cli neither supports SSL nor TLS.
However, a quick solution is to create an SSL tunnel to the redis using stunnel. This program is designed to work as an SSL encryption wrapper between remote client and local/remote server. We can use it to add SSL functionality to almost any daemon without any changes in its code.
That’s the theoretical part. We will setup SSL tunnel to access Redis on an Ubuntu server. Let’s install some necessary packages:
$ sudo apt update $ sudo apt install redis stunnel -y
Now we will write a configuration file for stunnel. Let’s create a file:
$ sudo touch /etc/stunnel/stunnel.conf
Please paste the following lines at this file. Here we are mapping our local 6379 port to the Redis node’s 6379 port. Please don’t forget to do the necessary changes.
[redis-cli] client = yes accept = localhost:6379 connect = <aws_redis_master_host>:6379
Finally, we will start stunnel with our configuration file to take effect, using this command:
$ sudo stunnel /etc/stunnel/stunnel.conf
If everything is fine, then we should see a successful message.
stunnel: LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP stunnel: LOG5[ui]: Reading configuration from file /stunnel.conf stunnel: LOG5[ui]: UTF-8 byte order mark not detected stunnel: LOG5[ui]: FIPS mode disabled stunnel: LOG4[ui]: Service [redis-cli] needs authentication to prevent MITM attacks stunnel: LOG5[ui]: Configuration successful
That’s all. Let’s connect to the Redis with the following command:
$ redis-cli -c -h localhost -p 6379 -a <SomeSecretPassword>
Let’s try to access our data.
localhost:6379> PING PONG localhost:6379> SET mykey "Hello" OK localhost:6379> GET mykey "Hello" localhost:6379> quit
That’s the quick workaround of turning any insecure TCP port into a secure encrypted port using stunnel. And dramatically this solves our problem of accessing AWS Redis.