如何使用Stunnel和redis-cli通过TLS连接到托管Redis实例

系统管理员 2022-11-28 15:27 110阅读 0赞

### 介绍 **(**Introduction**)** ###

A managed [Redis][] instance can provide benefits like high availability and automated updates. However, any time you make a connection to a remote database server, you run the risk of malicious actors [sniffing][] the sensitive information you send to it.

托管[Redis][]实例可以提供诸如高可用性和自动更新之类的好处。 但是，无论何时与远程数据库服务器建立连接，都存在着恶意行为者[嗅探][sniffing]发送给它的敏感信息的风险。

[`redis-cli`][redis-cli], the Redis command line interface, doesn’t natively support connections over [TLS][], a cryptographic protocol that allows for secure communications over a network. This means that without further configuration, `redis-cli` is not a secure way to connect to a remote Redis server. One way to establish a secure connection to a managed Redis instance is to create a [tunnel][] that uses the TLS protocol.

Redis命令行界面[`redis-cli`][redis-cli]本身不支持[TLS上的][TLS]连接， [TLS][]是一种允许通过网络进行安全通信的加密协议。 这意味着，如果没有进一步的配置， `redis-cli`并不是连接到远程Redis服务器的安全方法。 建立与托管Redis实例的安全连接的一种方法是创建使用TLS协议的[隧道][tunnel] 。

[Stunnel][] is an open-source proxy used to create secure tunnels, allowing you to communicate with other machines over TLS. In this guide, we will walk through installing and configuring stunnel so you can connect to a managed Redis instance over TLS with `redis-cli`.

[Stunnel][]是用于创建安全隧道的开源代理，允许您通过TLS与其他计算机进行通信。 在本指南中，我们将逐步完成安装和配置tunnel的过程，以便您可以使用`redis-cli`通过TLS连接到托管Redis实例。

## 先决条件 **(**Prerequisites**)** ##

To complete this guide, you will need:

要完成本指南，您将需要：

*  Access to an Ubuntu 18.04 server. This server should have a non-root user with administrative privileges and a firewall configured with `ufw`. To set this up, follow our [initial server setup guide for Ubuntu 18.04][].
    
    访问Ubuntu 18.04服务器。 该服务器应具有具有管理特权的非root用户，并应使用`ufw`配置防火墙。 要进行设置，请遵循我们[针对Ubuntu 18.04的初始服务器设置指南][initial server setup guide for Ubuntu 18.04] 。
 *  A managed Redis database instance. The steps outlined in this tutorial were tested on a DigitalOcean Managed Redis Database, though they should generally work for managed databases from any cloud provider. To provision a DigitalOcean Managed Redis Database, follow our [Managed Redis product documentation][].
    
    托管Redis数据库实例。 本教程中概述的步骤已在DigitalOcean托管Redis数据库上进行了测试，尽管它们通常应适用于任何云提供商的托管数据库。 要配置DigitalOcean托管Redis数据库，请遵循我们的[Managed Redis产品文档][Managed Redis product documentation] 。

## 第1步-安装Stunnel和redis-cli **(**Step 1 — Installing Stunnel and redis-cli**)** ##

When you install a Redis server, it usually comes packaged with `redis-cli`. However, you can install `redis-cli` without the Redis server by installing the `redis-tools` package from the default Ubuntu repositories. You can also install stunnel from the default Ubuntu repositories by downloading the `stunnel4` package.

当您安装Redis服务器时，它通常与`redis-cli`打包在一起。 但是，您可以通过从默认的Ubuntu存储库安装`redis-tools`软件包来在没有Redis服务器的情况下安装`redis-cli` 。 您还可以通过下载`stunnel4`软件包从默认的Ubuntu存储库中安装stunnel。

First, update your server’s package index if you’ve not done so recently:

首先，如果您最近没有更新服务器的软件包索引，请执行以下操作：

*  sudo apt update
    
    sudo apt更新

Then install the `redis-tools` and `stunnel4` packages with APT:

然后使用APT安装`redis-tools`和`stunnel4`软件包：

*  sudo apt install redis-tools stunnel4
    
    sudo apt安装redis-tools stunnel4

When prompted, press `ENTER` to confirm that you want to install the packages.

出现提示时，请按`ENTER`以确认您要安装软件包。

You can check whether stunnel was installed correctly and its [systemd][] service is working by running the following command:

您可以通过运行以下命令来检查stunnel是否正确安装及其[系统][systemd]服务是否正常运行：

*  sudo systemctl status stunnel4
    
    sudo systemctl状态stunnel4

Output ● stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)
       Loaded: loaded (/etc/init.d/stunnel4; generated)
       Active: active (exited) since Thu 2019-09-12 14:34:05 UTC; 8s ago
         Docs: man:systemd-sysv-generator(8)
        Tasks: 0 (limit: 2362)
       CGroup: /system.slice/stunnel4.service
    
    Sep 12 14:34:05 stunnel systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)...
    Sep 12 14:34:05 stunnel stunnel4[2034]: TLS tunnels disabled, see /etc/default/stunnel4
    Sep 12 14:34:05 stunnel systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons).

Here, you can see that the stunnel service is active, though the process immediately exited. This tells us that stunnel is running, but it isn’t able to actually do anything since we haven’t yet configured it.

在这里，您可以看到stunnel服务处于活动状态，尽管该过程立即退出了。 这告诉我们stunnel正在运行，但是由于尚未配置，它实际上无法执行任何操作。

## 第2步-配置通道 **(**Step 2 — Configuring Stunnel**)** ##

Modern Linux systems rely on systemd for initializing and managing services and daemons. However, stunnel uses a SysV-style init script, which is based on the older [UNIX System V][] init system, for startup. You’ll need to modify the `/etc/default/stunnel4` file to enable this init script.

现代Linux系统依靠systemd来初始化和管理服务和守护程序。 但是，stunnel使用SysV风格的初始化脚本(该脚本基于较早的[UNIX System V][]初始化系统)进行启动。 您需要修改`/etc/default/stunnel4`文件以启用此初始化脚本。

Open this file with your preferred text editor. Here, we’ll use `nano`:

使用您喜欢的文本编辑器打开此文件。 在这里，我们将使用`nano` ：

*  sudo nano /etc/default/stunnel4
    
    须藤nano / etc / default / stunnel4

Find the `ENABLED` option near the top of the file. It will be set to `0` by default, but change this to `1` to enable stunnel to start at boot:

在文件顶部附近找到“ `ENABLED`选项。 默认情况下它将设置为`0` ，但是将其更改为`1`以使stunnel在启动时启动：

/etc/default/stunnel4

/ etc / default / stunnel4

# /etc/default/stunnel
    # Julien LEMOINE <speedblue@debian.org>
    # September 2003
    
    # Change to one to enable stunnel automatic startup
    ENABLED=1
    . . .

Save and close the file. If you used `nano` to edit the file, do so by pressing `CTRL+X`, `Y`, then `ENTER`.

保存并关闭文件。 如果您使用`nano`编辑文件，请按`CTRL+X` ， `Y` ，然后按`ENTER` 。

Next, you will need to create a configuration file for stunnel which will tell the program where it needs to route traffic.

接下来，您将需要为stunnel创建一个配置文件，该文件将告诉程序它将流量路由到何处。

Open a new file called `stunnel.conf` under the `/etc/stunnel` directory:

在`/etc/stunnel`目录下打开一个名为`stunnel.conf`的新文件：

*  sudo nano /etc/stunnel/stunnel.conf
    
    须藤nano /etc/stunnel/stunnel.conf

Add the following content to this file:

将以下内容添加到该文件：

/etc/stunnel/stunnel.conf

fips = no
    setuid = nobody
    setgid = nogroup
    pid = /home/sammy/pids/stunnel.pid
    debug = 7
    delay = yes
    [redis-cli]
      client = yes
      accept = 127.0.0.1:8000
      connect = managed_redis_hostname_or_ip:managed_redis_port

The first five lines in the file are *global options*, meaning they will apply to every service you include in this file:

文件中的前五行是*全局选项* ，这意味着它们将应用于您在此文件中包括的每个服务：

*  `fips`: Enables or disables stunnel’s FIPS 140-2 mode. In this mode, stunnel will validate that the connection meets the [Federal Information Processing Standard][]. Setting this to `no` disables this feature. Note that disabling this is not any less secure, but keeping it enabled (as it is by default) would require some extra configuration.
    
    `fips` ：启用或禁用通道的FIPS 140-2模式。 在这种模式下，Stunnel将验证连接是否符合[联邦信息处理标准][Federal Information Processing Standard] 。 将此设置为`no`将禁用此功能。 请注意，禁用此功能同样安全，但保持启用状态(默认情况下)将需要一些额外的配置。
 *  `setuid`: Defines the Unix user ID under which stunnel will run. By default, the stunnel process is owned by the **root** user. However, the [stunnel documentation recommends][] that you drop administrative privileges once the tunnel starts, as failing to do so poses a security risk. Setting the `setuid` parameter to `nobody` will cause **nobody**, an unprivileged user, to take ownership over the stunnel process once the tunnel has been established.
    
    `setuid` ：定义stunnel将在其下运行的Unix用户ID。 默认情况下，stunnel进程由**root**用户拥有。 但是，隧道[文档建议][stunnel documentation recommends]您在隧道启动后立即放弃管理特权，因为这样做会带来安全风险。 设置`setuid`参数， `nobody`会因为**没有人** ，未经授权的用户，一旦隧道已经建立勇于承担责任，在安全通道的过程。
 *  `setgid`: Defines the Unix group ID under which stunnel will run. As with `setuid`, this configuration specifies a group without any special privileges — **nogroup** — to avoid any potential security issues.
    
    `setgid` ：定义stunnel将在其下运行的Unix组ID。 与`setuid` ，此配置指定一个没有任何特殊特权的组**-nogroup-**以避免任何潜在的安全问题。
 *  `pid`: Defines a file location where stunnel will create a `.pid` file, a type of file that contains a process’s [PID][]. `.pid` files are typically used by other programs to find the PID of a running process. By default, stunnel creates a `.pid` file in the `/var/run/stunnel4/` directory but because the **nobody** user doesn’t have permission to access that directory, it will prevent the tunnel from starting correctly. Instead, this line specifies a file named `stunnel.pid` held in a directory called `pids` in the Ubuntu user’s home directory. We will create this directory and the `stunnel.pid` file shortly. As you add this line, be sure to change `sammy` to the name of your Ubuntu system user.
    
    `pid` ：定义stunnel将在其中创建`.pid`文件的文件位置，该文件类型是包含进程[PID][]的文件类型。 `.pid`文件通常由其他程序用来查找正在运行的进程的PID。 默认情况下，stunnel在`/var/run/stunnel4/`目录中创建一个`.pid`文件，但是由于**没人**用户没有访问该目录的权限，因此它将阻止隧道正确启动。 相反，此行指定了一个名为`stunnel.pid`的文件，该文件保存在Ubuntu用户主目录的`pids`目录中。 我们将很快创建此目录和`stunnel.pid`文件。 添加此行时，请确保将`sammy`更改为Ubuntu系统用户的名称。
 *  `debug`: Sets stunnel’s debugging level, which can range from `0` to `7`. In this example we’ll set it to `7`, the highest level available, as that will provide the most detailed information if stunnel runs into any issues. You can set it to any level you like, but be aware that the default setting is `5`.
    
    `debug` ：设置stunnel的调试级别，范围从`0`到`7` 。 在此示例中，我们将其设置为`7` ，这是可用的最高级别，因为如果stunnel遇到任何问题，它将提供最详细的信息。 您可以将其设置为任意级别，但请注意默认设置为`5` 。
 *  `delay`: When set to `yes`, this option causes stunnel to delay the DNS lookup for the address listed in the `connect` option. It will also prevent stunnel from caching IP addresses. This setting will help to keep the tunnel open even if the managed Redis instance goes offline, as can happen when scaling up your cluster.
    
    `delay` ：当设置为`yes` ，此选项使stunnel延迟对`connect`选项中列出的地址的DNS查找。 它还将防止stunnel缓存IP地址。 即使托管的Redis实例脱机，此设置也有助于使隧道保持打开状态，这在扩展群集时可能会发生。

The remaining lines are *service-level options*, and only apply to the tunnel we’ll create for `redis-cli`:

其余的行是*服务级别的选项* ，仅适用于我们将为`redis-cli`创建的隧道：

*  `[redis-cli]`: This is a *service name* and specifies that the following lines represent an individual service configuration for a client program. You can have more than one service in a stunnel configuration file, though each must be associated with an existing client application and you can’t have two services for the same application.
    
    `[redis-cli]` ：这是一个*服务名称，*并指定以下行代表客户端程序的单个服务配置。 尽管每个配置都必须与现有的客户端应用程序关联，并且在同一个应用程序中不能有两个服务，但是在一个stunnel配置文件中可以有多个服务。
 *  `client`: Setting this to `yes` tells stunnel to run in client mode, meaning that stunnel will connect to a TLS server (the managed Redis instance) rather than act as a TLS server.
    
    `client` ：将其设置为`yes`告诉stunnel以客户端模式运行，这意味着stunnel将连接到TLS服务器(托管的Redis实例)，而不是充当TLS服务器。
 *  `accept`: Defines the host and port on which stunnel will accept connections from the client. Here, we specify the IP address `127.0.0.1`, which is an IPv4 loopback address used to represent **localhost**, and port `8000`. This means stunnel will listen for connections originating from the Ubuntu server on port `8000` and encrypt them. Note that you can set the port to any port number you like as long as it’s not already in use.
    
    `accept` ：定义主机和端口，Stunnel将在该主机和端口上接受来自客户端的连接。 在这里，我们指定IP地址`127.0.0.1`和端口`8000` ，该地址是用于表示**localhost**的IPv4回送地址。 这意味着stunnel将侦听来自端口`8000`上的Ubuntu服务器的连接并对其进行加密。 请注意，您可以将端口设置为所需的任何端口号，只要它尚未使用即可。
 *  `connect`: Defines the remote address and port to which stunnel will make the connection. Be sure to change this parameter to align with your managed database’s port and hostname or IP address.
    
    `connect` ：定义通道将与之`connect`的远程地址和端口。 确保更改此参数以使其与托管数据库的端口和主机名或IP地址保持一致。

**Note:** The hostname or IP address and port you should specify in the `connect` directive will be specific to your own managed Redis database. These can usually be found in your cloud provider’s database management user interface where you provisioned your Redis instance.

**注意：**您应该在`connect`指令中指定的主机名或IP地址和端口将特定于您自己的托管Redis数据库。 这些通常可以在您配置了Redis实例的云提供商的数据库管理用户界面中找到。

If you’re using a DigitalOcean Managed Redis Database, you can find this information by going to your [**Control Panel**][Control Panel] and clicking on **Databases** in the left-hand sidebar menu. Then, click on the name of the Redis instance you want to connect to and scroll down to the **Connection Details** section. There, you will find fields describing your database’s **host** and **port**.

如果您使用的是DigitalOcean托管Redis数据库，则可以通过转到“ [**控制面板”**][Control Panel]并单击左侧边栏菜单中的“ **数据库”**来找到此信息。 然后，单击要连接的Redis实例的名称，然后向下滚动到“ **连接详细信息”**部分。 在那里，您将找到描述数据库的**host**和**port的**字段。

This is a fairly minimal configuration that leaves many of stunnel’s default settings in place. The program has many options available for you to create tunnels that suit your particular needs. See [the official documentation][] for more details.

这是一个相当小的配置，可以保留许多stunnel的默认设置。 该程序具有许多选项，可用于创建满足特定需要的隧道。 有关更多详细信息，请参见[官方文档][the official documentation] 。

After adding this content, save and close the file.

添加此内容后，保存并关闭文件。

Next, make sure you’re in your Ubuntu user’s home directory:

接下来，确保您位于Ubuntu用户的主目录中：

*  cd
    
    光盘

Then create the `pids` directory which will hold the `stunnel.pid` file:

然后创建将保存`stunnel.pid`文件的`pids`目录：

*  mkdir pids
    
    mkdir pids

The stunnel process will create the `stunnel.pid` file automatically, so you don’t need to create the file yourself. However, you do need to change ownership of the `pids` directory over to the **nobody** user and **nogroup** group:

stunnel进程将自动创建`stunnel.pid`文件，因此您无需自己创建文件。 但是，你需要的改变所有权`pids`到**nobody**用户和**nogroup**组目录：

*  sudo chown -R nobody:nogroup pids/
    
    须藤chown -R none：nogroup pids /

Then, restart the `stunnel4` service so stunnel will read the new configuration file:

然后，重新启动`stunnel4`服务，以便stunnel将读取新的配置文件：

*  sudo systemctl restart stunnel4
    
    sudo systemctl重新启动stunnel4

Following that, you can test whether stunnel successfully created a tunnel by invoking `netstat`, a command line utility used to display network connections. Run the following command, which pipes the `netstat` output into a `grep` command, which in turn searches it for every instance of `stunnel`:

之后，您可以通过调用`netstat` (一个用于显示网络连接的命令行实用程序)来测试stunnel是否成功创建了隧道。 运行以下命令，将`netstat`输出通过管道`netstat`到`grep`命令，该命令依次在其中搜索`stunnel`每个实例：

*  sudo netstat -plunt | grep stunnel
    
    须藤netstat -plunt | grep隧道

Output  tcp        0      0 127.0.0.1:8000         0.0.0.0:*               LISTEN      17868/stunnel

This output shows that stunnel is listening for connections on local port `8000`.

此输出表明stunnel正在侦听本地端口`8000`上的连接。

You can also confirm that the **nobody** user has taken ownership over the stunnel process with `ps`, a program that displays all currently-running processes:

您还可以使用`ps`确认**无人**用户已经对隧道进程拥有所有权，该程序将显示所有当前正在运行的进程：

*  ps aux | grep stunnel
    
    ps aux | grep隧道

Output  nobody   15674  0.0  0.1 121912  3180 ?        Ssl  19:28   0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf
    . . .

Here, you can see that **nobody** has indeed taken over the stunnel process.

在这里，您可以看到**没有人**确实接管了隧道程序。

Stunnel is now fully configured and running on your system. You’re ready to connect to your managed Redis instance and test that the tunnel is working as expected.

现在，Stunnel已完全配置并在您的系统上运行。 您已准备好连接到托管Redis实例，并测试隧道是否按预期工作。

## 步骤3 —通过TLS连接到托管数据库 **(**Step 3 — Connecting To Your Managed Database over TLS**)** ##

Now that you’ve installed `redis-cli` and configured stunnel on your server, you’re ready to connect to your managed database over TLS.

现在，您已经在服务器上安装了`redis-cli`并配置了stunnel，现在可以通过TLS连接到托管数据库了。

Based on the settings defined in the configuration file created in Step 2, you would connect to your managed database with the following command:

根据在步骤2中创建的配置文件中定义的设置，您将使用以下命令连接到托管数据库：

*  redis-cli -h localhost -p 8000
    
    redis-cli -h本地主机-p 8000

This command includes the `-h` flag, which tells `redis-cli` that the next argument will be the host to connect to. In this case, it’s `localhost` since we’re connecting to a tunnel created locally on the server. After that is the `-p` flag, which precedes the port of the local tunnel we’re connecting to, which in this case is port `8000`.

该命令包括`-h`标志，该标志告诉`redis-cli`下一个参数将是要连接的主机。 在这种情况下，它是`localhost`因为我们正在连接到服务器上本地创建的隧道。 在这之后是`-p`标志，该标志位于我们要连接的本地隧道端口之前，在本例中为端口`8000` 。

After running that command, you will be connected to your managed Redis server. Your prompt will change to reflect that you’ve connected and are in `redis-cli`’s interactive mode:

运行该命令后，您将连接到托管Redis服务器。 您的提示将更改以反映您已连接并处于`redis-cli`的交互模式：

**Note:** Oftentimes, managed databases are configured to require users to authenticate with a password when they connect. If your managed Redis instance requires a password, you can include the `-a` flag in your `redis-cli` command, followed by your password:

**注意：**通常，将托管数据库配置为要求用户在连接时使用密码进行身份验证。 如果托管的Redis实例需要密码，则可以在`redis-cli`命令中包含`-a`标志，然后输入密码：

*  redis-cli -h localhost -p 8000 -a password
    
    redis-cli -h本地主机-p 8000 -a 密码

Alternatively, you can authenticate by running the `auth` command followed by your password after establishing the connection:

另外，您可以在建立连接后通过运行`auth`命令和密码来进行身份验证：

*  auth password
    
    验证密码

If you’re using a DigitalOcean Managed Database, you can find your Redis instance’s password in the same place you found its hostname and port. In your **Control Panel**, click on **Databases** in the left-hand sidebar menu. Then, click on the name of the Redis instance you’ve connected to. Scroll down to the **Connection Details** section, and there you’ll find a field labeled **password**. Click on the **show** button to reveal the password, then copy and paste it into either of these commands — replacing `password` — in order to authenticate.

如果使用的是DigitalOcean托管数据库，则可以在找到主机名称和端口的位置找到Redis实例的密码。 在**控制面板中** ，单击左侧边栏菜单中的“ **数据库** ”。 然后，单击您已连接的Redis实例的名称。 向下滚动到“ **连接详细信息”**部分，您会在这里找到一个名为**password**的字段。 单击**显示**按钮以显示密码，然后将其复制并粘贴到以下两个命令(替换`password` )中以进行身份验证。

You can test whether the tunnel is working as expected by running the `ping` command from Redis’s interactive mode:

您可以通过从Redis的交互模式运行`ping`命令来测试隧道是否按预期工作：

*  ping
    
    ping

If the connection is alive it will return `PONG`:

如果连接仍然存在，它将返回`PONG` ：

Output  PONG

If, however, stunnel is not tunnelling traffic from your server to your Redis instance correctly, you may see an error message like this before being disconnected from Redis:

但是，如果stunnel无法正确地将流量从服务器传输到Redis实例，则在与Redis断开连接之前，您可能会看到如下错误消息：

Output  Error: Server closed the connection

If you receive this or a similar error, double check that you’ve entered your Redis instance’s hostname and port correctly in your `stunnel.conf` file. Likewise, be sure that you entered the correct port number in your `redis-cli` command.

如果收到此错误或类似错误，请仔细检查您是否已在`stunnel.conf`文件中正确输入了Redis实例的主机名和端口。 同样，请确保在`redis-cli`命令中输入了正确的端口号。

You may also receive this error when the managed Redis instance resets its open connections, as can happen when you scale up your cluster’s configuration. In such cases, you may not be disconnected from Redis, although you will need to reauthenticate.

当托管Redis实例重置其打开的连接时，您也可能会收到此错误，例如在扩展群集的配置时可能会发生。 在这种情况下，尽管您需要重新进行身份验证，但您可能不会与Redis断开连接。

Once you’ve confirmed that the tunnel is working, go ahead and disconnect from your Redis instance:

确认隧道可以正常工作后，继续进行操作，并与Redis实例断开连接：

*  exit
    
    出口

If you ever change stunnel’s configuration, you’ll need to reload or restart the `stunnel4` service so stunnel will notice the changes:

如果您更改了stunnel的配置，则需要重新加载或重新启动`stunnel4`服务，以便stunnel会注意到更改：

*  sudo systemctl reload stunnel4
    
    sudo systemctl重新加载stunnel4

If at any point in the future you want to close the TLS tunnel, you can also do so with `systemctl`:

如果将来希望关闭TLS隧道，也可以使用`systemctl`这样做：

*  sudo systemctl stop stunnel4
    
    sudo systemctl停止stunnel4

After the tunnel has ben closed, you can reopen the tunnel by starting the service again:

在关闭隧道后，您可以通过重新启动服务来重新打开隧道：

*  sudo systemctl start stunnel4
    
    sudo systemctl启动stunnel4

Now that you’ve successfully configured stunnel, you’re all set to begin adding data to your managed Redis instance with `redis-cli`.

既然您已经成功配置了stunnel，就可以开始使用`redis-cli`将数据添加到托管Redis实例中了。

## 结论 **(**Conclusion**)** ##

Stunnel is a handy tool for creating TLS tunnels and establishing secure connections to remote servers. This is especially useful in cases where the secure transport of information between machines is critical, as with a remote database.

Stunnel是用于创建TLS隧道并建立与远程服务器的安全连接的便捷工具。 这在机器之间安全地传输信息至关重要的情况下(如远程数据库)尤其有用。

From here, you can begin exploring Redis and integrating it with your next application. If you’re new to working with Redis, you may find our series on [How To Manage a Redis Database][] useful.

从这里，您可以开始探索Redis并将其与下一个应用程序集成。 如果您不熟悉Redis，可能会发现有关“ [如何管理Redis数据库”的][How To Manage a Redis Database]系列[文章][How To Manage a Redis Database]很有用。

> 翻译自: [https://www.digitalocean.com/community/tutorials/how-to-connect-to-managed-redis-over-tls-with-stunnel-and-redis-cli][https_www.digitalocean.com_community_tutorials_how-to-connect-to-managed-redis-over-tls-with-stunnel-and-redis-cli]

[Redis]: https://redis.io/
[sniffing]: https://en.wikipedia.org/wiki/Sniffing_attack
[redis-cli]: https://redis.io/topics/rediscli
[TLS]: https://en.wikipedia.org/wiki/Transport_Layer_Security
[tunnel]: https://en.wikipedia.org/wiki/Tunneling_protocol
[Stunnel]: https://www.stunnel.org/
[initial server setup guide for Ubuntu 18.04]: https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-18-04
[Managed Redis product documentation]: https://www.digitalocean.com/docs/databases/redis/how-to/create/
[systemd]: https://en.wikipedia.org/wiki/Systemd
[UNIX System V]: https://en.wikipedia.org/wiki/UNIX_System_V
[Federal Information Processing Standard]: https://en.wikipedia.org/wiki/FIPS_140-2
[stunnel documentation recommends]: https://www.stunnel.org/config_unix.html
[PID]: https://en.wikipedia.org/wiki/Process_identifier
[Control Panel]: https://cloud.digitalocean.com/login
[the official documentation]: https://www.stunnel.org/static/stunnel.html
[How To Manage a Redis Database]: https://www.digitalocean.com/community/tutorial_series/how-to-manage-a-redis-database
[https_www.digitalocean.com_community_tutorials_how-to-connect-to-managed-redis-over-tls-with-stunnel-and-redis-cli]: https://www.digitalocean.com/community/tutorials/how-to-connect-to-managed-redis-over-tls-with-stunnel-and-redis-cli