Security Best Practices | Best Practices

1. Disable Unprotected Access

By default, Redis is configured to be accessed only from localhost. This is a good security measure to prevent unauthorized access. Make sure Redis is not exposed to the internet.

In the Redis configuration file redis.conf, ensure the following line is present:

bind 127.0.0.1

2. Use Strong Passwords

Set a strong password for Redis to prevent unauthorized access. You can set a password in the redis.conf file.

Add the following line to redis.conf:

requirepass yourstrongpassword

3. Rename Dangerous Commands

Some Redis commands can be dangerous if accessed by unauthorized users. Consider renaming these commands to prevent misuse.

In the redis.conf file, rename commands as follows:

rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command CONFIG ""

4. Enable Firewall

Use a firewall to restrict access to Redis. Only allow trusted hosts to connect to your Redis instance.

For example, using ufw on Ubuntu, you can restrict access as follows:

sudo ufw allow from 192.168.1.0/24 to any port 6379

Rule added
Rule added (v6)

5. Use TLS

Encrypting traffic between clients and Redis server using TLS is important to protect data in transit. Ensure you have a valid TLS certificate.

In the redis.conf file, enable TLS as follows:

tls-port 6379
tls-cert-file /path/to/server-cert.pem
tls-key-file /path/to/server-key.pem
tls-ca-cert-file /path/to/ca-cert.pem

6. Regular Updates

Ensure your Redis server and related software are regularly updated to the latest versions to benefit from security patches and improvements.

On Ubuntu, you can update Redis using:

sudo apt-get update
sudo apt-get install redis-server

7. Monitor and Audit

Regularly monitor and audit Redis logs to detect any unusual activities. Ensure you have proper logging configured.

In the redis.conf file, set the log file path:

logfile /var/log/redis/redis-server.log

Security Best Practices - Redis