iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

ACL & TLS

By · Reviewed & last updated · Part of Redis Tutorial

Redis was designed to live inside a trusted network. The defaults are dangerous on the open internet: no auth, plaintext wire, FLUSHALL exposed, EVAL accepts arbitrary Lua. Treat any production instance as a privileged service: bind it to a private network, require strong auth (ACLs), enable TLS, and disable the commands that you do not need.

Hardening redis.conf and using ACLs and TLS

EXAMPLE
# 1) redis.conf — bind to private interfaces only
bind 10.0.0.5 127.0.0.1
protected-mode yes
port 0                              # disable plaintext TCP entirely
tls-port 6379
tls-cert-file /etc/redis/server.crt
tls-key-file  /etc/redis/server.key
tls-ca-cert-file /etc/redis/ca.crt
tls-auth-clients yes                # mTLS — clients must present a cert

# 2) Strong, unique credentials via ACL — replace 'requirepass' on modern Redis
# Default user with no powers (deny-all)
user default off

# Application user: minimum command surface, single keyspace prefix
user app on >app-strong-secret \
     ~app:* \
     +@read +@write +@hash +@string +@list +@set +@sortedset +@geo \
     -flushdb -flushall -keys -config -debug -shutdown -script

# Admin user: only used from ops jumphost (or via Vault dynamic creds)
user admin on >admin-strong-secret allkeys allchannels +@all

# 3) Rename or disable dangerous commands across the board
rename-command FLUSHALL ''
rename-command FLUSHDB  ''
rename-command CONFIG   CFG_q9XmZ          # leaks reduce if name is unguessable
rename-command DEBUG    ''
rename-command SCRIPT   ''                 # disable Lua entirely if you do not use it

# 4) Persistence and memory limits — pin RAM, evict predictably
maxmemory 4gb
maxmemory-policy allkeys-lru
save 900 1
save 300 10

# 5) Slow log + auth attempt monitoring
slowlog-log-slower-than 10000               # 10 ms

# 6) Verify from the client
redis-cli --tls --cert client.crt --key client.key --cacert ca.crt -a app-strong-secret PING
redis-cli ACL WHOAMI
redis-cli ACL LIST
redis-cli INFO clients

# 7) Backups: write RDB to encrypted storage, not the same node
# *.aof and *.rdb contain raw key data — protect them like a DB dump.

# 8) Network: even with auth + TLS, keep Redis inside a private subnet
#    and front it with a security group / firewall that only allows the
#    app subnet on port 6379.

Why it matters

ACLs deprecate the old single-password model (requirepass) and let you grant the smallest possible blast radius per role. Combine them with rename-command for FLUSHALL/CONFIG/DEBUG and even a leaked app password cannot cost you the whole dataset.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# redis.conf
requirepass s3cret
rename-command FLUSHALL ""
bind 127.0.0.1
# ACL
ACL SETUSER app +get +set -keys *
Try it Yourself »

Discussion

Loading…