phpRedisAdmin icon indicating copy to clipboard operation
phpRedisAdmin copied to clipboard

Feature Request - Support TLS

Open gwharton opened this issue 2 years ago • 5 comments

Please support tls connections for redis servers.

AWS Elasticache redis instances with AUTH enabled now only support tls connections.

gwharton avatar Jan 24 '23 18:01 gwharton

In theory this is already possible. I don't have a setup to test. But I think you can set host to something like tls://hostname?ssl[verify_peer]=0 or tls://hostname?ssl[cafile]=private.pem&ssl[verify_peer]=1. Can you check if that works?

erikdubbelboer avatar Jan 27 '23 05:01 erikdubbelboer

Ahh yes, it should work, but looking at the code, only if you do not set the port variable.

https://github.com/erikdubbelboer/phpRedisAdmin/blob/bf71b74103b4aa506606f63344835f13ac42294d/includes/common.inc.php#L116-L121

gwharton avatar Jan 27 '23 09:01 gwharton

I tried not setting the port variable to see if I could use a full connection string, and alas the following code automatically sets the port setting if it doesn't exist. https://github.com/erikdubbelboer/phpRedisAdmin/blob/bf71b74103b4aa506606f63344835f13ac42294d/includes/config.environment.inc.php#L45-L54 I'm guessing this only becomes an issue when setting the servers from environment variables, i.e in docker. I haven't been able to try this when setting the servers from config.inc.php which I suspect will work if you don't declare a port.

gwharton avatar Jan 27 '23 10:01 gwharton

OK, ive tried it using the config file instead of environment variables.

      array(
          'name'   => 'master.xxxx.xxxx.euw2.cache.amazonaws.com',
          'host'   => 'tls://master.xxxx.xxxx.euw2.cache.amazonaws.com:6379',
          'port'   => '',
          'filter' => '*',
          'scheme' => 'tcp',
          'path'   => '',
          'hide'   => false,
          'auth' => 'xxxx'
      )

This works and seems to connect to the redis server.

gwharton avatar Jan 27 '23 10:01 gwharton

Great, I'll keep this task open for if one day I have time to improve support and fix that port logic.

erikdubbelboer avatar Jan 28 '23 05:01 erikdubbelboer