Managing Access Control Lists
1. Creating ACL Users
ACL SETUSER alice on >strongpass ~cache:* +@read +@write -@dangerous| Token | Meaning |
|---|---|
on/off | Enable/disable user |
>pass / <pass | Add/remove password |
#sha256-hex | Store hashed password |
nopass | No password required |
~pattern | Allow keys matching pattern |
&channel-pat | Pub/Sub channel pattern |
+cmd / -cmd | Allow/deny command |
+@category | Allow command group |
2. Listing ACL Users
| Command | Returns |
|---|---|
ACL LIST | Definition strings (rewritten) |
ACL USERS | Usernames only |
3. Getting User Details
| Command | Returns |
|---|---|
ACL GETUSER name | Flags, passwords, key patterns, commands |
4. Deleting ACL Users
| Command | Description |
|---|---|
ACL DELUSER u1 u2 ... | Remove and kick connections |
5. Setting User Passwords
| Token | Effect |
|---|---|
>newpass | Add password |
<oldpass | Remove password |
resetpass | Drop all passwords |
resetkeys / resetchannels | Drop key/channel ACLs |
reset | Reset everything to default |
6. Enabling and Disabling Users
| Command | Description |
|---|---|
ACL SETUSER alice on | Enable |
ACL SETUSER alice off | Block new connections |
7. Granting Command Permissions
| Syntax | Use |
|---|---|
+command | Allow specific command |
+command|subcommand | Subcommand granularity |
-command | Deny |
allcommands | Equivalent to +@all |
nocommands | Deny all |
8. Using ACL Categories and Subcommands
| Category | Examples |
|---|---|
@read | GET, HGET, ZRANGE |
@write | SET, DEL, ZADD |
@dangerous | FLUSHALL, KEYS, CONFIG |
@admin | CLIENT, SHUTDOWN |
@fast / @slow | By worst-case complexity |
ACL CAT | List all categories |
9. Restricting Key Patterns
| Token | Effect |
|---|---|
~pat | Allow read+write on matching keys |
%R~pat | Read-only key pattern 7.0+ |
%W~pat | Write-only key pattern |
allkeys | Equivalent to ~* |
10. Loading ACL from File
| Directive | Description |
|---|---|
aclfile /etc/redis/users.acl | External ACL definitions |
ACL LOAD | Re-read file |
11. Saving ACL Configuration
| Command | Description |
|---|---|
ACL SAVE | Persist runtime ACLs to file |
12. Checking Current User
| Command | Returns |
|---|---|
ACL WHOAMI | Current authenticated user |
13. Logging ACL Events
| Command | Description |
|---|---|
ACL LOG [count|RESET] | Recent denied accesses |