[ZBXNEXT-7121] Add user auth support for zabbix-agent2 redis plugin Created: 2021 Dec 13  Updated: 2025 Mar 03  Resolved: 2025 Mar 03

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: Agent2 plugin (G)
Affects Version/s: None
Fix Version/s: 7.0.10rc1, 7.2.4rc1, 7.4.0alpha1

Type: New Feature Request Priority: Trivial
Reporter: Juri Malinovski Assignee: Eriks Sneiders
Resolution: Fixed Votes: 11
Labels: None
Remaining Estimate: 0h
Time Spent: 8h
Original Estimate: Not Specified

Issue Links:
Related
related to ZBXNEXT-9491 Plugins.Redis.Sessions.<SessionName>.... Confirmed
Sub-task
part of ZBXNEXT-9722 Add password and user macros to Redis... Open
Team: Team INT
Sprint: Sprint candidates
Story Points: 2

 Description   

Redis since 6 version, supports user ACL (ACL user password), go-redis also supports Options.Username parameter in connection options since v7.3.

But redis plugin documentation said

"Embedded URI credentials (userinfo) are forbidden and will be ignored. So, you can't pass the credentials by this:

redis.ping[tcp://user:[email protected]] — WRONG"

I wonder, why. Using ACL like "user zabbix on +@connection +info +config +slowlog >password" and connection URI tcp://zabbix:password@localhost:6379 is more configurable and secure way, than using global admin password for all redis instances.

 Comments   
Comment by Joachim [ 2023 Feb 28 ]

I am willing to try working on this feature. How can I get started ? Do the project accepts merge requests ?

Comment by greg long [ 2023 Sep 30 ]

I also need this feature

using default user is not feasible in many cases as zabbix agent plugin seems to require +config which exposes many this we dpon;t wish to expose to default

Comment by Matthew Steeves [ 2023 Dec 02 ]

Just to add some more info, the Zabbix Agent2 plug-in for Redis uses the Radix Go client to interface with Redis.
I found that in the Redis plug-in (conn.go on line 148), Zabbix uses the Radix call DialAuthPass(), which only takes a password. Per Radix's docs, in version 3.5.0 they added DialAuthUser(), which takes both username and password. Guessing this wasn't available at time Zabbix was developing the plugin...

I haven't tried this (yet), but wanted to put what I learned from digging I was doing today. Personally, I'm going to first see if we can use the Unix socket approach instead.

Comment by Pietro Marini (RCA Systems) [ 2024 Mar 11 ]

Any update on this issue? I think that in many situations, it wouldn't be acceptable to not have authentication on Redis because the monitoring agent doesn't support it.

Comment by Matthew Steeves [ 2024 Mar 15 ]

Hey Marini, I ended up extending the agent and got redis monitoring working with a username and password. Wasn't terribly hard. I just compiled the customizations on one agent and am running all my redis checks from there. It ends up being about 9 lines of code changes, and then 4 lines of template changes to use the new functionality. If you want more detail, let me know.

Comment by Pietro Marini (RCA Systems) [ 2024 Mar 15 ]

Thanks for sharing Matthew.Steeves2, that's interesting.

If I got you correctly, you had to:

  1. modify Zabbix Agent 2 code and compile it
  2. change the template

While 2. would be just filing a merge  request [here|https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/db/redis?at=release/6.4,] the modification 1. would need merging into a much larger code base.

In any case, yes, please give more details

Comment by Eriks Sneiders [ 2025 Feb 04 ]

Implemented in 

Comment by Marianna Zvaigzne [ 2025 Feb 27 ]

Documented in:

  • What's new in Zabbix (7.0.10, 7.2.4)
  • Appendixes > Process configuration > Zabbix agent 2 plugins > Redis plugin (7.0, 7.2, 7.4)
Generated at Sat Mar 29 03:31:49 EET 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.