How to install and secure Redis on a Linux VPS

Redis is an in-memory data store that apps use for caching, sessions and queues. It is fast and simple, but a default install trusts anyone who can reach its port. This guide installs Redis from your distribution's packages, keeps it on localhost, adds authentication and checks that systemd supervises it.

Before you start

• A Linux VPS running Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
• A user with sudo rights. If you only have root, see create a sudo user.
• An SSH session to the server. The login details are in your VPS provider's control panel.

Install Redis

Ubuntu and Debian

sudo apt update
sudo apt install redis-server

The main config file is /etc/redis/redis.conf and the service is called redis-server.

AlmaLinux and Rocky Linux

sudo dnf install redis
sudo systemctl enable --now redis

The service is called redis. The config file location differs between releases, so ask the package where it put it:

rpm -qc redis

Look for redis.conf in the output. It is usually /etc/redis/redis.conf on version 9 and /etc/redis.conf on version 8. Use that path wherever this guide says /etc/redis/redis.conf.

Keep Redis on localhost

If only apps on the same server use Redis, it should listen on the loopback address only. Open the config file:

sudo nano /etc/redis/redis.conf

Find the bind line and make sure it reads:

bind 127.0.0.1 -::1

The - before ::1 tells Redis to carry on if IPv6 is not available. Also check that protected mode is on:

protected-mode yes

Protected mode refuses connections from other hosts when no password is set. It is a safety net, not a replacement for a password.

Require a password or an ACL user

You have two options. Use one of them.

Option 1: a single password

Find the commented # requirepass line and set your own long, random password. Generate one with:

openssl rand -base64 32

Then add it to the config (the value below is an example only, so use your own):

requirepass StrongPassword123!ReplaceMe

Clients then send AUTH <password> before running commands.

Option 2: ACL users

ACLs let you give each app its own user with limited rights. Add a line like this to redis.conf, using your own password:

user default off
user appuser on >StrongPassword123!ReplaceMe ~app:* &* +@all -@dangerous

This turns off the passwordless default user and creates appuser, who can only touch keys starting with app: and cannot run commands in the @dangerous group, such as FLUSHALL or CONFIG.

Keep the file private, because it now holds a secret:

sudo chmod 640 /etc/redis/redis.conf

Let systemd supervise Redis

In the config file, set:

supervised systemd

This lets Redis tell systemd when it is ready, so restarts and status reports are accurate. Packaged versions often set this already. Restart and enable the service:

# Ubuntu and Debian
sudo systemctl restart redis-server
sudo systemctl enable redis-server

# AlmaLinux and Rocky Linux
sudo systemctl restart redis

Check it started cleanly:

systemctl status redis-server   # or: systemctl status redis

You should see active (running).

Check it works

Confirm Redis only listens on localhost:

sudo ss -ltnp | grep 6379

The output should show 127.0.0.1:6379 and [::1]:6379, not 0.0.0.0:6379.

Now connect with redis-cli and try a command without logging in:

redis-cli ping

With authentication on, you get NOAUTH Authentication required. Log in and try again. Typing the password at the prompt keeps it out of your shell history:

redis-cli

127.0.0.1:6379> AUTH appuser your-password-here
OK
127.0.0.1:6379> SET app:test hello
OK
127.0.0.1:6379> GET app:test
"hello"

If you used requirepass, run AUTH your-password-here with no username.

Troubleshooting

• Service fails to start after editing: a typo in redis.conf stops Redis. Read the log with journalctl -u redis-server -n 50 (or -u redis) to find the line it rejected.
• App gets NOAUTH or WRONGPASS errors: the app is not sending the new password or username. Update its Redis settings, then restart the app.
• NOPERM errors: the ACL user lacks rights to that key or command. Widen the key pattern or command list for that user only.
• Could not connect to Redis: check systemctl status and confirm the app connects to 127.0.0.1, not the public IP.
• Redis needed from another server: do not open port 6379 to the internet. Allow only that server's IP with your firewall, for example with UFW rules for one IP, and keep authentication on.

Next steps

• Store app data in a relational database too: Install MySQL 8.4 on Ubuntu and Debian.
• Close every port you do not need: Set up UFW on Ubuntu and Debian.