Implementing Security and Authentication
1. Setting Password
| Directive | Description |
|---|---|
requirepass <strong-pass> | Default user password |
2. Authenticating Clients
| Command | Form |
|---|---|
AUTH password | Legacy single-user |
AUTH username password | ACL-based 6.0+ |
3. Binding to Specific Interfaces
| Directive | Example |
|---|---|
bind | bind 127.0.0.1 10.0.0.5 |
bind 0.0.0.0 | All interfaces RISKY |
4. Enabling Protected Mode
| Directive | Default |
|---|---|
protected-mode yes | Reject external connections without auth/bind |
5. Disabling Dangerous Commands
rename-command FLUSHALL ""
rename-command CONFIG "CONFIG_x9k2"
rename-command DEBUG ""| Command | Risk |
|---|---|
FLUSHDB / FLUSHALL | Data loss |
CONFIG | Runtime reconfig |
DEBUG | Server manipulation |
KEYS | O(N) blocking scan |
6. Using TLS/SSL Encryption
| Directive | Description |
|---|---|
tls-port 6379 | Enable TLS |
port 0 | Disable plain text |
7. Configuring TLS Certificates
tls-cert-file /etc/redis/server.crt
tls-key-file /etc/redis/server.key
tls-ca-cert-file /etc/redis/ca.crt8. Validating Client Certificates
| Directive | Effect |
|---|---|
tls-auth-clients yes | Require client certs (default) |
tls-auth-clients optional | Accept anonymous |
9. Using Mutual TLS Authentication
| Step | Detail |
|---|---|
| Server | Presents cert signed by trusted CA |
| Client | Presents cert; server verifies via tls-ca-cert-file |
10. Configuring TLS Protocols and Ciphers
| Directive | Example |
|---|---|
tls-protocols | "TLSv1.2 TLSv1.3" |
tls-ciphers | OpenSSL cipher string (≤TLS1.2) |
tls-ciphersuites | TLS 1.3 suites |
tls-prefer-server-ciphers yes | Server chooses |