什么是Redis改变自己的配置？

Question

Redis将自己的配置dir更改为/etc/cron.d，并将dbfile更改为ntp，而不是默认配置。一旦重新启动redis，它将重置为/var/lib/redis和dump.rdb，但过了一段时间，它会出现“未能打开RDB文件”的错误。

默认dire和rdb文件具有正确的权限，而redis只允许内部IP。

cli输出

127.0.0.1:6381> CONFIG GET dir
1) "dir"
2) "/etc/cron.d"
127.0.0.1:6381> CONFIG GET "dbfilename"
1) "dbfilename"
2) "ntp"

/var/log/redis/redis-server.log

3204:M 21 May 16:07:19.124 * Background saving terminated with success
3204:M 21 May 16:12:18.962 * 10000 changes in 60 seconds. Saving...
3204:M 21 May 16:12:18.967 * Background saving started by pid 25469
25469:C 21 May 16:12:20.931 * DB saved on disk
25469:C 21 May 16:12:20.934 * RDB: 3 MB of memory used by copy-on-write
3204:M 21 May 16:12:20.968 * Background saving terminated with success

3204:M 21 May 16:17:21.082 * 10 changes in 300 seconds. Saving...
3204:M 21 May 16:17:21.088 * Background saving started by pid 25865
25865:C 21 May 16:17:22.800 * DB saved on disk
25865:C 21 May 16:17:22.803 * RDB: 3 MB of memory used by copy-on-write
3204:M 21 May 16:17:22.891 * Background saving terminated with success
3204:M 21 May 16:17:43.669 # Failed opening the RDB file root (in server root dir /var/spool/cron) for saving: Read-only file system
3204:M 21 May 16:17:45.320 # Failed opening the RDB file ntp (in server root dir /etc/cron.d) for saving: Read-only file system
3204:M 21 May 16:22:23.086 * 10 changes in 300 seconds. Saving...
3204:M 21 May 16:22:23.092 * Background saving started by pid 26264
26264:C 21 May 16:22:23.093 # Failed opening the RDB file ntp (in server root dir /etc/cron.d) for saving: Read-only file system
3204:M 21 May 16:22:23.194 # Background saving error
3204:M 21 May 16:22:29.104 * 10 changes in 300 seconds. Saving...
3204:M 21 May 16:22:29.109 * Background saving started by pid 26265
26265:C 21 May 16:22:29.109 # Failed opening the RDB file ntp (in server root dir /etc/cron.d) for saving: Read-only file system
3204:M 21 May 16:22:29.209 # Background saving error
3204:M 21 May 16:22:35.016 * 10 changes in 300 seconds. Saving...

Answer 1

是您的服务器可以通过internet公开访问的吗？

最有可能的解释是有人连接到redis并发送命令远程重新配置它，试图控制服务器。

有机器人每天24小时扫描互联网，寻找暴露的软件和已知的漏洞。快速的经验法则是，在不到5分钟的时间内，一个新的在线服务就会被发现和攻击。(尝试运行一个未安装补丁的Windows服务器，并惊讶于它的持续时间有多短)。

考虑到redis和潜在的整个服务器被破坏了。我希望你在这个红皮书中没有敏感的信息，或者这是一个数据泄露。

阻止公共访问，解除虚拟机，从零开始设置一个新的.

相关红星票：https://github.com/antirez/redis/issues/3594