redis-security

Redis Security

Production hardening for Redis: authentication, ACL-based access control, and network exposure. Cover all three together — any one of them on its own leaves an exploitable gap.

When to apply

• Deploying or reviewing a Redis instance destined for production.
• Setting up application credentials beyond a shared password.
• Auditing a Redis deployment against a security checklist.
• Receiving "Redis exposed to the internet" findings from a scanner.

1. Always authenticate (and use TLS)

Never run a production Redis without a password. Pair authentication with TLS so credentials and data aren't sent in clear text.

# redis.conf
requirepass your-strong-password
tls-port 6380
tls-cert-file /path/to/redis.crt
tls-key-file  /path/to/redis.key

r = redis.Redis(
    host="localhost",
    port=6380,
    password="your-strong-password",
    ssl=True,
    ssl_cert_reqs="required",
)

The passwords shown in this skill are examples only. Replace each one with a long, unique, randomly generated secret for every user, and above all for the admin user. In client code, load the secret at runtime from the environment or a secret manager and keep it out of source control. Make the Redis config file and any ACL file readable only by the Redis service account.

Enabling the TLS port leaves the plaintext port listening. Once clients connect over TLS, turn off the plaintext listener by setting the plaintext port to zero. Configure a trusted CA certificate on the server and on every client so certificates are verified, decide deliberately whether to require client certificates, and connect using a hostname that matches the server certificate. Use TLS for replication and cluster traffic where they apply.

If you can use ACL users (next section) instead of the single requirepass, do — requirepass is effectively the legacy "default user" shortcut.

See references/auth.md.

2. ACLs for least-privilege access

The default user with a shared password is fine for development. For production, give each application a dedicated ACL user with only the commands and key patterns it actually needs.

# Cache-only reader
ACL SETUSER app_readonly on >password ~cache:* +get +mget

# Writer that can't run dangerous ops
ACL SETUSER app_writer   on >password ~*        +@all -@dangerous

# Admin (use sparingly, never for application traffic)
ACL SETUSER admin        on >strong-password ~* +@all

The writer example above is broad: all commands minus the dangerous category, on every key, still allows scripting, publish and subscribe, and access to every key. For a real application, restrict the key pattern to the prefix it uses and grant only the read and write commands it actually needs.

Key patterns do not filter SCAN results, so granting SCAN to a user exposes every key name in the database. Grant it only when the application truly needs to list keys.

In production, once the dedicated users exist, turn off the default user or give it a strong password and minimal rights, then review the result with ACL LIST.

ACL users created at runtime are lost on restart unless Redis is configured with an ACL file and the changes are saved to it, or the users are written to the config. Confirm the users are still present after a restart.

Useful command categories:

If app credentials leak, a tight ACL bounds the blast radius — the attacker can't FLUSHALL your DB just because they grabbed a cache reader's password.

See references/acls.md.

3. Restrict network access

The most common Redis breach is a public-internet Redis with no auth. Avoid that with three layers:

# redis.conf — bind to specific interfaces, keep protected-mode on
bind 127.0.0.1 192.168.1.100
protected-mode yes

Protected mode only applies when no password and no bind address are set, so treat it as a fallback rather than a substitute for authentication and firewall rules.

# Firewall — allow only application subnets
iptables -A INPUT -p tcp --dport 6379 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP

The addresses and subnet above are examples. Confirm the real private interface and application subnet with the user before applying them.

Apply the same firewall rules to every port Redis listens on, including the TLS port 6380, the cluster bus port, and any Sentinel port. Review the existing chain first, because appended rules can sit behind a broader accept rule. Add equivalent rules for IP version six and for any cloud security groups. These commands need root, and the rules must be saved deliberately so they survive a reboot.

Anti-pattern: bind 0.0.0.0 + protected-mode no — exposes Redis to the whole network without protection.

Optional but recommended: rename or disable destructive commands so a compromised client can't trash the DB. Denying dangerous commands through ACLs on users other than admin is the preferred control. Renaming commands is discouraged, does not replace ACLs, and renaming CONFIG or DEBUG can break Sentinel, monitoring, and managed tooling.

rename-command FLUSHALL ""
rename-command DEBUG ""
rename-command CONFIG ""

See references/network.md.

References

• Redis: Security
• Redis: ACL