Redis requirepass, ACLs, and Closing Port 6379

Binding Redis to localhost is necessary and not sufficient. A process on the same host, a published container port, or a later bind 0.0.0.0 edit will still reach an instance that has no password. Redis 6 and later give you ACL users. Older configs still use requirepass. Use one of them, keep 6379 off the public interface, and treat the host firewall as a third layer rather than a hope.

Default Redis trusts the network. There is no password, every command is allowed, and FLUSHALL is a single round trip. That default is acceptable only on a laptop loopback. On a VPS in Lucknow DC01 it is a data-loss and data-theft bug. Close it before the first application deploy.

requirepass is the older one-secret gate

requirepass sets a single password for every client. It is easy to reason about and easy to leak, because every app, every cron job, and every human shares it. Prefer it only when you cannot move to ACLs yet.

# /etc/redis/redis.conf
bind 127.0.0.1
protected-mode yes
port 6379
requirepass a-long-random-secret

After a restart, redis-cli without -a fails. AUTH then works. Do not put the password on the shell history if you can avoid it. Use a Redis URL in the application environment, or a redis-cli --askpass prompt when you debug by hand.

sudo systemctl restart redis-server
redis-cli ping
# NOAUTH Authentication required
redis-cli --askpass ping
# PONG

rename-command is a weak extra trick people still copy: rename FLUSHALL and CONFIG to empty strings. It breaks your own ops more often than it stops an attacker who already has the password. Put your energy into bind, a real secret, and ACLs.

ACL users replace the shared password

ACL SETUSER creates named users with a password, a key pattern, and a command set. That is the model you want once two applications share one Redis, or once a read-only dashboard should not be able to DEL.

redis-cli --askpass
ACL SETUSER cache on >cache-secret ~cache:* +ping +get +set +del +expire +ttl
ACL SETUSER app on >app-secret ~sess:* ~cache:* +@read +@write -flushall -flushdb -config
ACL SETUSER replica on >repl-secret +@replication +ping
ACL LIST
ACL SAVE

The default user is the trap. If it stays enabled with no password, any client that skips AUTH is still omnipotent. Disable it once the named users work.

ACL SETUSER default off
ACL SAVE

Store ACLFILE in redis.conf so the users survive a restart. On Debian-family packages that is often /etc/redis/users.acl. Confirm the path with the unit, then set aclfile and restart. A user that exists only in memory is gone after the next reboot, and the default user comes back if you have not persisted the off state.

Command categories such as +@read and +@write are faster to audit than a long allow list, but they are broad. Subtract the dangerous commands explicitly: -flushall -flushdb -config -shutdown -debug. Key patterns such as ~cache:* keep a reporting user out of session keys. Test the user with redis-cli --user cache --askpass and a GET of a key it should not see. A NOPERM reply is the success case.

Do not expose 6379, even with a password

A password is not a reason to publish the port. Brute force against Redis is cheap, and a leaked secret in an application repo becomes a public database the same day. Bind loopback, deny 6379 on the host firewall, and keep the public interface for SSH and the reverse proxy only.

ss -lntp | grep 6379
# 127.0.0.1:6379 only
sudo ufw deny 6379/tcp
redis-cli -h 203.0.113.10 ping
# Connection refused. Not NOAUTH. Refused.

NOAUTH on the public IP means the port is open and Redis is merely asking for a password. That is already a failure. Connection refused or a timeout is the result you want. If two VPS nodes must share Redis, bind the private address, restrict the firewall to that peer, and still use ACL users. Never publish 6379 on 0.0.0.0 because a tutorial used that bind line.

Netbay edge filtering is L3/L4 DDoS protection. It will not guess your Redis password or close a port you opened. The daemon config and the host firewall remain your job.

Takeaway

Disable the default user, give each app an ACL, and keep 6379 off the public interface. A password on an open port is still an open port. Spin up an Ubuntu 24.04 VPS on Netbay in under 60 seconds and lock the instance down before the first deploy — netbayhosts.in.