Use localhost and set redis password by default (#6481)

python/ray/cluster_utils.py

@@ -8,6 +8,7 @@ import time
 import redis
 
 import ray
+from ray import ray_constants
 
 logger = logging.getLogger(__name__)
 
@@ -91,7 +92,8 @@ class Cluster(object):
                 spawn_reaper=self._shutdown_at_exit)
             self.head_node = node
             self.redis_address = self.head_node.redis_address
-            self.redis_password = node_args.get("redis_password")
+            self.redis_password = node_args.get(
+                "redis_password", ray_constants.REDIS_DEFAULT_PASSWORD)
             self.webui_url = self.head_node.webui_url
         else:
             ray_params.update_if_absent(redis_address=self.redis_address)

python/ray/parameter.py

@@ -106,7 +106,7 @@ class RayParams(object):
                  redirect_output=None,
                  num_redis_shards=None,
                  redis_max_clients=None,
-                 redis_password=None,
+                 redis_password=ray_constants.REDIS_DEFAULT_PASSWORD,
                  plasma_directory=None,
                  worker_path=None,
                  huge_pages=False,

python/ray/ray_constants.py

@@ -195,3 +195,10 @@ PICKLE_BUFFER_METADATA = b"PICKLE"
 PICKLE5_BUFFER_METADATA = b"PICKLE5"
 
 AUTOSCALER_RESOURCE_REQUEST_CHANNEL = b"autoscaler_resource_request"
+
+# The default password to prevent redis port scanning attack.
+# Hex for ray.
+REDIS_DEFAULT_PASSWORD = "5241590000000000"
+
+# The default ip address to bind to.
+NODE_DEFAULT_IP = "127.0.0.1"

python/ray/scripts/scripts.py

@@ -98,6 +98,7 @@ def cli(logging_level, logging_format):
     "--redis-password",
     required=False,
     type=str,
+    default=ray_constants.REDIS_DEFAULT_PASSWORD,
     help="If provided, secure Redis ports with this password")
 @click.option(
     "--redis-shard-ports",

python/ray/tests/test_failure.py

@@ -729,11 +729,17 @@ def test_redis_module_failure(ray_start_regular):
     def run_failure_test(expecting_message, *command):
         with pytest.raises(
                 Exception, match=".*{}.*".format(expecting_message)):
-            client = redis.StrictRedis(host=address[0], port=int(address[1]))
+            client = redis.StrictRedis(
+                host=address[0],
+                port=int(address[1]),
+                password=ray_constants.REDIS_DEFAULT_PASSWORD)
             client.execute_command(*command)
 
     def run_one_command(*command):
-        client = redis.StrictRedis(host=address[0], port=int(address[1]))
+        client = redis.StrictRedis(
+            host=address[0],
+            port=int(address[1]),
+            password=ray_constants.REDIS_DEFAULT_PASSWORD)
         client.execute_command(*command)
 
     run_failure_test("wrong number of arguments", "RAY.TABLE_ADD", 13)

python/ray/tests/test_multi_node_2.py

@@ -60,7 +60,8 @@ def test_internal_config(ray_start_cluster_head):
 
 
 def setup_monitor(address):
-    monitor = Monitor(address, None)
+    monitor = Monitor(
+        address, None, redis_password=ray_constants.REDIS_DEFAULT_PASSWORD)
     monitor.subscribe(ray.gcs_utils.XRAY_HEARTBEAT_BATCH_CHANNEL)
     monitor.subscribe(ray.gcs_utils.XRAY_JOB_CHANNEL)  # TODO: Remove?
     monitor.update_raylet_map(_append_port=True)

python/ray/worker.py

@@ -534,7 +534,7 @@ def init(address=None,
          driver_object_store_memory=None,
          redis_max_memory=None,
          log_to_driver=True,
-         node_ip_address=None,
+         node_ip_address=ray_constants.NODE_DEFAULT_IP,
          object_id_seed=None,
          local_mode=False,
          redirect_worker_output=None,
@@ -542,7 +542,7 @@ def init(address=None,
          ignore_reinit_error=False,
          num_redis_shards=None,
          redis_max_clients=None,
-         redis_password=None,
+         redis_password=ray_constants.REDIS_DEFAULT_PASSWORD,
          plasma_directory=None,
          huge_pages=False,
          include_webui=False,