Install and secure Redis

Redis is an in-memory data store that applications use for caching, sessions and job queues. Out of the box it is meant for trusted networks only. In this guide you will install it, keep it bound to localhost, protect it with a password, and check that it works.

Before you begin

• An Ubuntu 24.04 LTS VPS. Ubuntu's repositories provide Redis 7.
• SSH access as a sudo user, such as alex.
• A password manager, or another safe place to store a long random password.
• Optional: the application that will use Redis, if it runs on the same server.

Step 1: Install Redis

Install the server package, which also brings redis-cli, the command-line client. Then print the version to confirm the install.

sudo apt update
sudo apt install -y redis-server
redis-server --version

Redis server v=7.0.x sha=00000000:0 malloc=jemalloc-5.3.0 bits=64 build=...

The package starts Redis as a systemd service and enables it at boot.

Step 2: Confirm it listens only on localhost

Redis uses TCP port 6379. The Ubuntu default configuration binds it to 127.0.0.1 and ::1, which means only processes on this server can reach it. Verify that:

sudo ss -tlnp | grep 6379

LISTEN 0  511  127.0.0.1:6379  0.0.0.0:*  users:(("redis-server",pid=...))

If you ever see 0.0.0.0:6379 or *:6379, Redis is reachable from the internet. Fix the bind line before doing anything else.

Step 3: Generate a strong password

This command prints 24 random bytes encoded as text. Copy the output somewhere safe; you will need it in the next two steps.

openssl rand -base64 24

kX3v9qLr2TzN7wQe1bYcHs0mPaUdFgJo

The string above is only an example. Generate your own.

Step 4: Set the password in redis.conf

Open the configuration file in nano. Press Ctrl+W to search for requirepass. Remove the leading # from that line, replace the placeholder with your password, and save with Ctrl+O, Enter, then Ctrl+X.

sudo nano /etc/redis/redis.conf

requirepass PASTE_YOUR_PASSWORD_HERE

If Redis is used as a cache, two more lines help it stay within memory. They cap memory use and tell Redis to evict the least recently used keys when full:

maxmemory 256mb
maxmemory-policy allkeys-lru

Step 5: Restart and test

Restart the service so it reads the new settings, then test with and without the password.

sudo systemctl restart redis-server
redis-cli ping
REDISCLI_AUTH='PASTE_YOUR_PASSWORD_HERE' redis-cli ping

(error) NOAUTH Authentication required.
PONG

The first attempt is refused, which is correct. The second passes the password through the REDISCLI_AUTH environment variable, so it is not shown in the process list. Commands typed into the shell can still be saved in your history, so clear the entry if you typed the real password there.

Step 6: Try a few commands interactively

Open the client, authenticate, and store a value.

redis-cli
AUTH PASTE_YOUR_PASSWORD_HERE
SET greeting "hello"
GET greeting
QUIT

OK
"hello"

Step 7: Confirm the firewall does not expose it

Redis should never appear in ufw's rules. Check the list:

sudo ufw status

Only SSH and any web ports should be listed. If 6379 appears, remove it with sudo ufw delete allow 6379.

Troubleshooting

• NOAUTH errors from your application: add the password to the application's Redis settings, usually as a URL such as redis://:PASSWORD@127.0.0.1:6379/0.
• WRONGPASS: the password in the client does not match requirepass. Compare the two values exactly.
• Service fails after editing: run sudo journalctl -u redis-server -n 20 --no-pager. It names the line with the error.
• Another server cannot connect: that is by design. Use the SSH tunnel guide to reach Redis from elsewhere.

Next steps

Point your application at 127.0.0.1:6379 with the password, then monitor memory use with the resource monitoring guide. For remote access, prefer an SSH tunnel over opening the port.