Questions related to security aspects, TLS, password hashing, logging ...

[UweBechthold]

Hello everyone,
I currently try to understand some security aspects of FalkorDB and hope you can answer the following questions:

1. I saw that TLS is supported beginning with the Startup, High Availability/Clustering with the Pro plan.
   Am I right that this is only applicable if I want to let FalkorDB run in the cloud? So, if I deploy it on my own infrastructure, I would not need those plans?

2. Does FalkorDB manage users and credentials separately from Redis on its own (a separate password management) or is it delegating this to Redis?
   There is an option in Redis to change the password hashing algorithm from SHA256 to PBKDF2. Does this affect the password hashing algorithm used for FalkorDB user credentials?
   Is FalkorDB (or if it is using Redis for credential handling) generating ad-hoc salts for new passwords and if, which hashing algorithm is used?

3. FalkorDB is providing logging functionality for ACL-related events and allows transferring them via OpenTelemetry. Since FalkorDB is a Redis module, do you know if the FalkorDB events are also logged by Redis, for example, administrator-related events via @admin? As a consequence, are the logs from FalkorDB a subset from the logs of Redis?

4. FalkorDB does not provide that many configuration options. Does FalkorDB inherit the TLS settings (version, ciphersuites) from the Redis configuration or is it possible to configure such? I could not find a configuration option for this.
   If there is no configuration option: Can you tell me which TLS version and ciphersuites are used by FalkorDB?

Thank you very much in advance.
Uwe

[gkorland]

1. If you self hosted you can run it as you can run it with replication.
2. FalkrDB is utilizing the underline Redis ACL, on FalkorDB Enterprise we have support for LDAP too.
3. FalkorDB is running as a Redis module, so FalkorDB logs are part of Redis logs.
4. FalkorDB is utziliing Redis TLS, so all the Redis TLS configurations are available. FalkorDB specific configuration can be found here: https://docs.falkordb.com/getting-started/configuration.html

[UweBechthold]

Thanks for the answers and your time.
I have a follow-up question to answer 2: If I understand you correctly, FalkorDB is using the Redis functionality for handling users and credentials. As a consequence, FalkorDB honors the password complexity rules configured in Redis, right? In addition, you mention LDAP for FalkorDB Enterprise. Just for clarification: Is LDAP possible in FalkorDB Enterprise only or on-premises, too?
Uwe

[dudizimber]

a. FalkorDB honors the password complexity rules configured in Redis
b. LDAP will be supported in FalkorDB Enterprise and on-prem, too.

[UweBechthold]

Thanks for the information, greatly appreciated.