How to secure Redis with authentication and firewall rules?

Type Your Question

How to secure Redis with authentication and firewall rules?

Monday, 17 March 2025

REDIS

Redis, known for its speed and versatility, is often used as a cache, message broker, and even a primary database. However, its default configuration offers minimal security, making it vulnerable to unauthorized access if not properly secured. This guide outlines essential security measures involving authentication and firewall rules to protect your Redis instance.

Why is Redis Security Important?

By default, Redis listens on all network interfaces (0.0.0.0) without any authentication. This means anyone with network access to your Redis server can potentially read, write, and delete data, execute commands, and compromise your entire application. Failing to secure your Redis instance can lead to data breaches, application downtime, and reputational damage.

1. Authentication: Requiring a Password

The most fundamental security measure is enabling password-based authentication. Redis provides a straightforward mechanism for this.

Configuring Password Authentication (`requirepass`)

Edit the Redis Configuration File: Locate your redis.conf file. The location varies depending on your installation but is commonly found at /etc/redis/redis.conf or /usr/local/etc/redis.conf. Use a text editor with administrative privileges to open it.
Uncomment and Set the requirepass Directive: Find the line starting with # requirepass foobared and remove the # to uncomment it. Replace foobared with a strong, unique password. For example:
```
requirepass MySuperSecurePassword123!
```
Important: Choose a strong password that's not easily guessable. Use a combination of uppercase and lowercase letters, numbers, and symbols.
Restart Redis: Save the changes to the redis.conf file and restart the Redis server for the changes to take effect. The command to restart Redis depends on your system. Common commands are:
```
sudo systemctl restart redis
```
or
```
sudo service redis restart
```
Authenticate When Connecting: After restarting, you'll need to authenticate every time you connect to the Redis server using the AUTH command:
```
redis-cli -h your_redis_host -p 6379 AUTH MySuperSecurePassword123!
```

With password authentication enabled, any connection attempt without the correct password will be rejected.

2. Advanced Authentication: Access Control Lists (ACLs)

For more granular control over user permissions, Redis offers Access Control Lists (ACLs), introduced in Redis 6. ACLs allow you to define specific users with tailored access to commands and keys.

Creating and Managing Users with ACLs

Access Redis-cli with Admin Privileges (Initial Authentication): First, if you have requirepass configured, you need to authenticate as the default user. Assuming the default user doesn't have sudo capabilities:
```
redis-cli -h your_redis_host -p 6379 AUTH MySuperSecurePassword123!
```
Now that you have the permissions you are looking for, it is time to define your new user
Creating a User: Use the ACL SETUSER command to create a new user. For example, to create a user named myappuser with a password, restricted to only executing GET and SET commands on keys matching the pattern data:*, and allowed to access databases 0 and 1, you'd use:
```
ACL SETUSER myappuser +GET +SET ~data:* on >myappuserpassword
```
- myappuser: The username.
- +GET +SET: Allows the user to execute the GET and SET commands. Use - to deny commands. You can use ALLCOMMANDS and NOCOMMANDS as shortcuts.
- ~data:*: Restricts access to keys matching the pattern "data:*". * allows access to all keys.
- on: Allows access to the specific database ID. Databases are referenced as numbers. Example for dabase 0 would be on ~data:*
- >myappuserpassword: Sets the password for the user to "myappuserpassword".
Authenticating with the New User: Connect to Redis using the new user credentials:
```
redis-cli -h your_redis_host -u myappuser -p 6379 -a myappuserpassword
```
Modifying User Permissions: Use ACL SETUSER again to modify an existing user's permissions. For example, to add the DEL command to the myappuser's allowed commands, you would run:
```
ACL SETUSER myappuser +DEL >myappuserpassword
```
Listing Users and their Permissions: The ACL LIST command shows all configured users and their permissions:
```
ACL LIST
```
Deleting a User: The ACL DELUSER command removes a user:
```
ACL DELUSER myappuser
```
Resetting the default user access(since there isn't an official delete user). :
```
ACL SETUSER default +@all
```

ACLs provide a significantly more secure approach than a simple password by minimizing the impact of a compromised account.

3. Firewall Rules: Limiting Network Access

Even with authentication enabled, it's crucial to restrict network access to your Redis instance. A firewall acts as a gatekeeper, controlling which IP addresses or networks can connect to your Redis server.

Using iptables (Linux)

iptables is a common firewall utility on Linux systems.

Allow Traffic from Specific IP Address: To allow only connections from a specific IP address (e.g., 192.168.1.100) to port 6379 (Redis default port):
```
sudo iptables -A INPUT -p tcp --dport 6379 -s 192.168.1.100 -j ACCEPT
```
Allow Traffic from Specific Network: To allow connections from a specific network (e.g., 192.168.1.0/24):
```
sudo iptables -A INPUT -p tcp --dport 6379 -s 192.168.1.0/24 -j ACCEPT
```
Deny All Other Traffic: After allowing specific IPs or networks, deny all other traffic to the Redis port:
```
sudo iptables -A INPUT -p tcp --dport 6379 -j DROP
```
Save the iptables Rules: The above rules are added to the running iptables configuration, but they won't persist after a reboot. To make the rules permanent, save them using:
```
sudo iptables-save > /etc/iptables/rules.v4
```
The way the rules persist between reboots, depends greatly on what Linux distribution and init process you are utilizing

Important: Ensure you allow access from your application servers, monitoring systems, and any other services that need to communicate with Redis *before* denying all other traffic. A locked out Redis is useless.

Using UFW (Uncomplicated Firewall) - Linux

UFW is another firewall utility on Linux (often used on Ubuntu) that offers a simplified interface.

Allow Traffic from Specific IP Address: To allow only connections from a specific IP address (e.g., 192.168.1.100) to port 6379:
```
sudo ufw allow from 192.168.1.100 to any port 6379 proto tcp
```
Allow Traffic from Specific Network: To allow connections from a specific network (e.g., 192.168.1.0/24):
```
sudo ufw allow from 192.168.1.0/24 to any port 6379 proto tcp
```
Deny All Other Traffic (and enable UFW): After allowing necessary access, deny all other traffic to the Redis port, and then enable UFW:
```
sudo ufw default deny incoming
sudo ufw enable
```
Checking UFW status: Ensure the rules are as expected and are in force:
```
sudo ufw status
```

Cloud Provider Firewalls (AWS, Azure, GCP)

If your Redis instance is hosted in the cloud (AWS, Azure, GCP), utilize their native firewall services:

AWS: Security Groups control inbound and outbound traffic for EC2 instances.
Azure: Network Security Groups (NSGs) provide similar functionality to AWS Security Groups.
GCP: Firewall Rules within Virtual Private Cloud (VPC) networks manage network access.

Configure these firewall rules to allow only necessary traffic to your Redis instances based on IP addresses or service accounts.

4. Bind to Specific Interfaces (`bind`)

Another security measure is to bind Redis to specific network interfaces rather than listening on all interfaces (0.0.0.0). This limits the accessibility of Redis to only the specified interfaces.

Configuring the `bind` Directive

Edit the Redis Configuration File: Open your redis.conf file.
Find the bind Directive: Locate the line starting with # bind 127.0.0.1 ::1. Remove the # to uncomment it.
Specify Interface(s): Replace the default values with the IP address(es) of the interfaces you want Redis to listen on. For example, to bind to a single interface with IP address 192.168.1.200, use:
```
bind 192.168.1.200
```
To bind to multiple interfaces, list them separated by spaces:
```
bind 127.0.0.1 192.168.1.200
```
Restart Redis: Save the changes and restart the Redis server.

Binding to specific interfaces significantly reduces the attack surface of your Redis instance.

5. Additional Security Considerations

Disable Unnecessary Commands: The rename-command directive in redis.conf can rename or disable potentially dangerous commands like FLUSHALL, FLUSHDB, KEYS, CONFIG, and SHUTDOWN. Example
```
rename-command FLUSHALL ""
```
This line disables FLUSHALL command, and nobody is allowed to use the original name "FLUSHALL".
Keep Redis Updated: Regularly update your Redis installation to the latest version to benefit from security patches and bug fixes.
Monitor Redis Activity: Use monitoring tools to track Redis performance and detect suspicious activity, such as unusual command patterns or unauthorized connection attempts.
Run Redis as a non-root user : Running the Redis server process under a non-privileged user helps mitigate damage from security exploits that may escalate privileges
Data Encryption in Transit (TLS/SSL): Encrypt data in transit to prevent eavesdropping. Stunnel or similar tools can wrap Redis connections in TLS.

Conclusion

Securing Redis is essential for protecting your data and applications. Implementing strong authentication mechanisms (password/ACLs) and restricting network access through firewalls are critical first steps. Combining these with other security best practices, such as command disabling, regular updates, and monitoring, will significantly strengthen your Redis security posture. By taking these precautions, you can safeguard your Redis instances and the sensitive data they hold.