Redis - Security

Modern Redis Security

Securing a Redis instance is critical to protect your data from unauthorized access and to prevent malicious use of your server’s resources. Modern Redis security goes beyond a simple password and involves a layered approach.

1. Authentication: Passwords and ACLs

The first line of defense is requiring clients to authenticate. While a simple password is a good start, modern Redis (version 6.0 and newer) offers a much more powerful feature: Access Control Lists (ACLs).

Basic Password Authentication (Legacy & Default User)

This method controls access to the entire server with a single password. It’s configured via the requirepass directive. The recommended way is to set this in your redis.conf file, as dynamically setting it with CONFIG SET can be disabled for security reasons.

# In your redis.conf file:
requirepass "your-very-strong-and-secret-password"

After setting this, any client must authenticate using the AUTH command before executing any other commands.

> AUTH your-very-strong-and-secret-password
OK
> SET user:1:session "some-data"
OK

Without authentication, Redis will return an error:

> SET user:1:session "some-data"
(error) NOAUTH Authentication required.

Modern Approach: Access Control Lists (ACLs) (Redis 6+)

ACLs are the preferred method for modern Redis security. They allow you to create multiple users with different passwords and granular permissions. You can define rules for which commands a user can run and which keys they can access.

Here’s an example of creating a limited user named app-user that can only read and write keys prefixed with app: and can use the PUBLISH command on the logs channel.

# Create a new user with a password and specific permissions
> ACL SETUSER app-user on >somepassword ~app:* +@read +@write +publish|logs
OK

# Authenticate as the new user
> AUTH app-user somepassword
OK

# This command is allowed
> SET app:user:1 "data"
OK

# This command is NOT allowed (wrong key pattern)
> SET other:user:1 "data"
(error) NOPERM this user has no permissions on this key

# This command is NOT allowed (insufficient permissions)
> FLUSHALL
(error) NOPERM this user has no right to run the 'flushall' command

2. Network and OS-Level Security

Authentication is not enough. You must also secure the environment where Redis runs.

• Bind to Localhost: By default, Redis (in protected mode) only listens on the localhost interface (127.0.0.1). If your application and Redis are on the same machine, leave this setting. If Redis needs to be accessible over a network, bind it to a private network IP, not a public one. In redis.conf: bind 192.168.1.100.
• Protected Mode: This is a security feature enabled by default. If protected-mode is on, Redis only replies to clients connecting from localhost unless a password is configured or it’s explicitly bound to other IPs.
• Firewall: Use a firewall (like iptables or ufw on Linux) to restrict access to the Redis port (default 6379) to only trusted application servers.
• Disable/Rename Dangerous Commands: You can disable commands that could be harmful if misused (like FLUSHALL, KEYS, CONFIG) by renaming them to an empty string in redis.conf: rename-command FLUSHALL "".
• Run as a Non-root User: Create a dedicated redis user and group with limited permissions to run the Redis process. This minimizes potential damage if the server is compromised.

3. Encryption

By default, communication with Redis is not encrypted. If you are sending sensitive data over a network that is not secure, you should enable TLS/SSL to encrypt the traffic. This requires Redis 6.0+ and proper certificate configuration. In redis.conf:

# redis.conf TLS/SSL configuration example
port 0
tls-port 6379
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt

Security Best Practices: A Checklist

• ✅ Use Redis 6.0+ for ACL and TLS support.
• ✅ Always set a strong, complex password (requirepass) or configure ACL users.
• ✅ Use fine-grained ACL rules instead of a single global password.
• ✅ Bind Redis to a trusted network interface, never a public IP.
• ✅ Keep protected-mode enabled.
• ✅ Use a firewall to limit access to the Redis port.
• ✅ Disable or rename dangerous commands.
• ✅ Run Redis as a dedicated non-root user.
• ✅ Enable TLS for encrypted communication over untrusted networks.