--- title: "How to Perform a Secure Redis Install on Linux" description: "Learn how to do the Redis install then secure your Redis server with a password, and set up a firewall in this step-by-step tutorial!" canonical: "https://adamtheautomator.com/redis-install/" --- # How to Perform a Secure Redis Install on Linux > Learn how to do the Redis install then secure your Redis server with a password, and set up a firewall in this step-by-step tutorial! Source: https://adamtheautomator.com/redis-install/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Perform a Secure Redis Install on Linux](https://adamtheautomator.com/wp-content/uploads/2021/12/How-to-Perform-a-Secure-Redis-Install-on-Linux.jpg) # How to Perform a Secure Redis Install on Linux [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)28 December 20218 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Command Line](/tag/command-line/)[Linux](/tag/linux/)[Redis](/tag/redis/) Table of Contents * [Prerequisites](#prerequisites) * [Redis Install with the APT Package Manager](#redis-install-with-the-apt-package-manager) * [Configuring the Redis.conf File to Run Redis as a Service](#configuring-the-redisconf-file-to-run-redis-as-a-service) * [Testing if the Redis Server Functions Properly](#testing-if-the-redis-server-functions-properly) * [Binding the Redis Server to Localhost](#binding-the-redis-server-to-localhost) * [Securing Redis Server Connection with a Password](#securing-redis-server-connection-with-a-password) * [Disabling Dangerous Commands to Protect your Redis Server](#disabling-dangerous-commands-to-protect-your-redis-server) * [Blocking Connection Request to Redis Server with a Firewall](#blocking-connection-request-to-redis-server-with-a-firewall) * [Conclusion](#conclusion) [Redis](https://redis.io/) is beneficial for many things, one of which is caching. You can also use Redis as a primary data store or even as a replacement for a database. But how do you execute a secure Redis install? Installing Redis can be a pain, and if you’re not careful, you could end up with many errors. Lucky for you, this tutorial has got you covered. In this tutorial, you’ll learn how to securely install Redis on your Linux system, along with some tips to avoid common mistakes. Read on and save yourself the headaches from troubleshooting Redis installation errors! ## Prerequisites This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following: * An Ubuntu 20.04 LTS machine – This tutorial uses Ubuntu 20.04 LTS, but the instructions are similar for most Linux distributions. Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) * [Root](https://linoxide.com/give-normal-user-root-privileges/) privileges or a non-root user with [`sudo`](https://linuxize.com/post/how-to-create-a-sudo-user-on-ubuntu/) privileges ## Redis Install with the APT Package Manager There are a few ways to install Redis on Ubuntu, but for this tutorial, you’ll go with the [APT](http://manpages.ubuntu.com/manpages/bionic/man8/apt.8.html) package manager to install Redis. > _Redis is written in C, so you’d need to compile Redis from its source code manually. Several dependencies would need to be installed, and the build process isn’t exactly foolproof._ > > _Compiling Redis from source isn’t recommended, but the upside is that you can customize your installation if you like. You download the source code, then manually configure it._ Open your terminal and run the `apt update` command below to [ensure you have the latest package lists](https://www.linkedin.com/pulse/why-run-sudo-apt-get-update-everytime-jitendra-sikarwar/). ```bash sudo apt update -y ``` ![Updating the Linux system](https://adamtheautomator.com/wp-content/uploads/2021/12/image-232.png) Updating the Linux system Now, run the `apt install` command below to install Redis on your machine. The below command uses the `apt` package manager to download and install the `redis-server` package from the Ubuntu repositories onto your machine. The `-y` flag tells `apt` to accept prompts during the installation process automatically. Related:[How to Use the Ansible apt Module to Manage Linux Packages](https://adamtheautomator.com/ansible-apt/) ```bash sudo apt install redis-server -y ``` ![Installing Redis on your machine](https://adamtheautomator.com/wp-content/uploads/2021/12/image-233.png) Installing Redis on your machine ## Configuring the Redis.conf File to Run Redis as a Service You’ve just installed Redis, but it’s not ready for use yet. Before you can start using Redis, you’ll first configure the _redis.conf_ file. The _redis.conf_ configuration file is included with the Redis package you installed and is stored in the _/etc/redis/_ directory by default. This file contains all of the [configuration options](https://redis.io/topics/config) for Redis. > _The .conf file extension is logical, as it follows a conventional pattern. Many other programs use this same style. The [Apache](https://apache.org/) web server, for example, uses the .conf file extension for its main configuration file._ 1\. Run the following `systemctl` command to `stop` the `redis-server` service. Stopping the Redis service from running is a recommended practice when you’re first getting started with Redis. ```powershell sudo systemctl stop redis.service ``` Related:[Controlling Systemd services with Ubuntu systemctl](https://adamtheautomator.com/ubuntu-systemctl/) 2\. Next, open the _/etc/redis/redis.conf_ file in your preferred text editor. Find the **supervised** directive, then set it to **systemd**, as shown below, and save the changes. Doing so tells the operating system to run Redis as a service. ![Setting up the systemd directive](https://adamtheautomator.com/wp-content/uploads/2021/12/image-234.png) Setting up the systemd directive 3\. Now, run the `systemctl restart` command below to restart the Redis service (`redis.service`) since the Redis service doesn’t know about the changes yet. ```bash sudo systemctl restart redis.service ``` 4\. Finally, run the `systemctl status` command below to see if Redis is running. ```bash sudo systemctl status redis.service ``` As you can see below, the output shows that the Redis service is running. ![Checking if Redis Service is Running](https://adamtheautomator.com/wp-content/uploads/2021/12/image-235.png) Checking if Redis Service is Running ## Testing if the Redis Server Functions Properly You’ve configured and verified that the Redis service is actively running, but that doesn’t mean the Redis server is working. How to test if the Redis server functions properly? Connect to the Redis server and send commands to see if the server responds. 1\. Run the `redis-cli` command below to connect to the Redis server. [`redis-cli`](https://redis.io/topics/rediscli) is the command-line interface for Redis, which allows you to send commands to the server and inspect its state. ```bash redis-cli ``` Below, you can tell that you’re in the Redis server prompt (**127.0.0.1:6379>**). The `redis-cli` command tries to connect to a Redis server at `127.0.0.1:6379` by default. ![Connecting to the Redis Server](https://adamtheautomator.com/wp-content/uploads/2021/12/redis-cli.png) Connecting to the Redis Server 2\. Next, run the `ping` command below to check if the Redis server is reachable. ```bash ping ``` As you can see, the server returned **PONG**, which indicates the Redis server is reachable and can now successfully communicate with the service. ![Pinging the Redis server ](https://adamtheautomator.com/wp-content/uploads/2021/12/pong.png) Pinging the Redis server Perhaps you’re still skeptical; run the `set` command below. The [`set`](https://redis.io/commands/set) command is a Redis command that sets a key-value pair in a database. ```bash set test "This is a test" ``` As you can see, the set command returns “**OK**,” which indicates that the Redis service is working correctly. ![Testing the Redis server](https://adamtheautomator.com/wp-content/uploads/2021/12/image-236.png) Testing the Redis server 3\. Run the `exit` command below to exit the `redis-cli`. Doing so closes the connection to the Redis server. ```bash exit ``` ## Binding the Redis Server to Localhost You’ve just tested that the Redis server works properly, but it might be accessible from other devices on your network too. This behavior is undesirable, and you’d typically want to protect your Redis server from strangers. Binding the Redis server to localhost sets a behavior that only the machine on which you installed Redis can access the Redis server. 1\. Open the _/etc/redis/redis.conf_ file in your text editor. 2\. Locate the line that says `bind 127.0.0.1 ::1` and uncomment the line by deleting the number sign (**`#`**) at the beginning of the line. ![](https://adamtheautomator.com/wp-content/uploads/2021/12/image-237.png) Uncommenting the bind 127.0.0.1 ::1 line 3\. Now, run the command below to restart the `redis-server` service. ```bash sudo systemctl restart redis-server ``` 4\. Finally, run the following command to check if your Redis server is bound to localhost. The `netstat -lnp` command lists all active network connections, and the `grep redis` part filters the output to lines that contain “`redis`.” `-lnp` stands for Local Name Protocol, a networking protocol used by UNIX-like systems to resolve hostnames to IP addresses. ```bash sudo netstat -lnp | grep redis ``` You can see below that the Redis server is now listening on the localhost interface only (`127.0.0.1:6379`). Reflecting the change in the configuration file, you can see that only the localhost interface is listed under your active internet connections (`tcp`). Now, no other devices on your network can connect to your Redis server. ![Listing all active network connections](https://adamtheautomator.com/wp-content/uploads/2021/12/image-238.png) Listing all active network connections ## Securing Redis Server Connection with a Password At this point, Redis isn’t set to require users to authenticate with a password. Anyone who knows your Redis server’s IP address or hostname could connect to it and change its data. How do you protect your Redis server? Set a password to require users for authentication when connecting to your Redis server. 1\. Re-open the _redis.conf_ configuration file in your text/code editor. 2\. Next, set a strong password with the following: * Look for `requirepass foobared` under the `SECURITY` section * Delete the number sign (`#`) at the beginning of the line * Replace `foobared` with a strong password of your choice and save the changes ![Providing a secure password](https://adamtheautomator.com/wp-content/uploads/2021/12/image-239.png) Providing a secure password 3\. Run the following commands to restart and connect to your Redis server. ```bash sudo systemctl restart redis-server redis-cli ``` 4\. Now, run the `ping` command to see if you’ll get a response from the server. ```powershell ping ``` Below, you can see an error message that says **NOAUTH Authentication required**. This message indicates that you need an authentication password to access your Redis server remotely. ![Testing connection with the server](https://adamtheautomator.com/wp-content/uploads/2021/12/image-240.png) Testing connection with the server 5\. Run the below `auth` command followed by your password to authenticate your connection to your Redis server. ```bash auth Qae9p_fY:YjdtJ7k ``` You will get an **OK** response when authentication is successful, like the one below. ![Authenticating Redis Server Connection](https://adamtheautomator.com/wp-content/uploads/2021/12/image-241.png) Authenticating Redis Server Connection 6\. Finally, rerun the `ping` command to test if you’ve authenticated your connection to your Redis server. ```bash ping ``` You’ll now get the **PONG** response, as shown below, after authenticating your connection. At this point, you have now successfully protected your Redis server with a password. ![Pinging the Redis server](https://adamtheautomator.com/wp-content/uploads/2021/12/image-242.png) Pinging the Redis server ## Disabling Dangerous Commands to Protect your Redis Server Setting a password to authenticate the connection to your Redis server doesn’t mean it gets 100% protection. By default, Redis includes several dangerous commands that allow users to change the data in your database. When run by unauthorized users, these commands allow intruders to read, modify, destroy, and even wipe out the data of your Redis database. Below is not a comprehensive list as your Redis server may have additional dangerous commands, but in most cases, these are the dangerous commands: ```powershell FLUSHDB, FLUSHALL, KEYS, PEXPIRE, DEL, CONFIG, SHUTDOWN, BGREWRITEAOF BGSAVE, SAVE, SPOP, SREM, RENAME, DEBUG, EVAL ``` To further secure your Redis server, rename these dangerous commands in the _redis.conf_ file: 1\. Open the _redis.conf_ file in your text editor and look for the **Command renaming** section. Rename commands to an empty string to disable them following the below syntax. Replace `the-command` with the actual command to disable. ```bash rename-command the-command "" ``` For example, disable the `CONFIG` command by renaming `CONFIG` to an empty string, as shown below, then save the changes. The double quotes (**“”)** indicate an empty string that signifies disabling a command. ![Renaming the CONFIG command](https://adamtheautomator.com/wp-content/uploads/2021/12/image-243.png) Renaming the `CONFIG` command 2\. Exit from the text editor and run the command below to restart the Redis server. ```bash sudo systemctl restart redis-server ``` 3\. Now run the following commands to connect to your Redis server. ```bash redis-cli auth Qae9p_fY:YjdtJ7k ``` 4\. Finally, run the [`config get`](https://redis.io/commands/config-get) command to test that the `CONFIG` command is disabled. ```bash config get requirepass ``` You will get an **ERR unknown command `config`** response, as shown below, which indicates that the `CONFIG` command is disabled. ![Checking the CONFIG command ](https://adamtheautomator.com/wp-content/uploads/2021/12/image-244.png) Checking the `CONFIG` command If the `config get requirepass` command pushes through, it requests your Redis server for the password to authenticate the connection to your Redis server. You have now successfully renamed a dangerous Redis command to protect your Redis server. Now keep disabling other dangerous commands in the _redis.conf_ file. ## Blocking Connection Request to Redis Server with a Firewall Another way to secure your Redis server is to set up a firewall. Setting up a firewall requires you to allow only the required port for each of the services running on your server. For example, if you are running Redis on your server at port `6379`, then that port is what you only need to open. If you need to allow access from a specific IP address or range of addresses, you can add those addresses to the firewall rules. To set up a firewall, you’ll first install a firewall configuration tool. This example uses [UFW](https://help.ubuntu.com/community/UFW), a commonly used firewall configuration tool on Linux. But you can also use another tool, such as [iptables,](https://linux.die.net/man/8/iptables) to set up a firewall. 1\. Run the following command to install UFW on your machine. ```bash sudo apt install ufw -y ``` 2\. Next, run the below command to enable UFW. ```bash sudo ufw enable ``` Enter ‘Y’ when you get the prompt shown below to continue running the command. ![Enabling UFW](https://adamtheautomator.com/wp-content/uploads/2021/12/image-245.png) Enabling UFW 3\. Run the `ufw` command below to add a rule, which allows (`allow`) traffic on port `6379` for your Redis server. Replace the `11.22.33.44` IP address with the IP addresses of your intended users. ```bash sudo ufw allow from 11.22.33.44 to any port 6379 ``` ![Adding a firewall rule to allow traffic on port 6379](https://adamtheautomator.com/wp-content/uploads/2021/12/image-246.png) Adding a firewall rule to allow traffic on port `6379` 4\. Lastly, run the command below to verify that you’ve added the firewall rule successfully. The command checks the `status` of your firewall. ```bash sudo ufw status ``` You can see in the output below that the firewall is **active** and has the rule to allow traffic on port `6379` for Redis from the IP address `11.22.33.44`. ![Checking the UFW rules ](https://adamtheautomator.com/wp-content/uploads/2021/12/image-247.png) Checking the UFW rules Now, any users with the IP address of `11.22.33.44` can connect to Redis via port `6379` and will need to authenticate with a password. You can add additional ports for other services in a similar fashion. ## Conclusion Throughout this tutorial, you’ve learned how to install and secure your Redis server by renaming dangerous commands to empty strings and setting up a firewall. With this newfound knowledge, you can enjoy the full benefits of Redis without worrying about exposing your server to unnecessary risks. Wish to learn more? Why not start with [securing a Redis server in Kubernetes](https://kasna.com.au/securing-redis-server-in-kubernetes/)? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fredis-install%2F&text=How%20to%20Perform%20a%20Secure%20Redis%20Install%20on%20Linux)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fredis-install%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fredis-install%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/09/Practical-Linux-Unix-Tee-Commands-for-the-Linux-Admin.jpg) ### [Master Unix tee Commands for Real-World Linux Admin Tasks](/unix-tee/) Simplify Linux output management and streamline your workflow with the “Unix tee” command. This tutorial guides you through its practical applications. ![](https://adamtheautomator.com/wp-content/uploads/2022/09/Useful-Linux-Dig-Examples-for-the-Network-Admin.jpg) ### [Linux Dig for Network Admins: Practical Guide with Examples](/linux-dig/) Become a network troubleshooting expert! This comprehensive Linux Dig guide empowers you with essential DNS query commands for immediate results. ![](https://adamtheautomator.com/wp-content/uploads/2021/12/install-phpmyadmin.jpg) ### [Step-by-Step Tutorial to Install phpMyAdmin Securely on Linux](/install-phpmyadmin/) Discover how to securely install phpMyAdmin on Linux with our concise guide. Learn essential steps for a safe and efficient setup, tailored for Linux users. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)