Install and secure Redis

Redis is an in-memory database used as a cache, message queue or session store. Its speed comes from keeping everything in RAM and answering on an unencrypted port: an instance exposed to the Internet is compromised very quickly. Debian installation is simple; the real work is restricting listening, authenticating clients and choosing suitable persistence.

Install and verify

sudo apt update
sudo apt install -y redis-server
systemctl status redis-server
redis-cli ping

The expected answer is PONG. The service listens on 127.0.0.1:6379 by default; confirm with ss -ltnp | grep 6379. Redis should never be reached directly from your desktop: use an SSH tunnel to inspect data.

Local listening and protected mode

In /etc/redis/redis.conf, keep:

bind 127.0.0.1 ::1
protected-mode yes
port 6379

bind limits interfaces; protected-mode rejects unauthenticated connections from elsewhere. Do not open 6379 in UFW. A password alone does not protect a public port from brute force or an application flaw.

Password and ACLs

For an instance with a single client, requirepass is enough:

requirepass long-password

sudo systemctl restart redis-server
REDISCLI_AUTH='long-password' redis-cli ping

REDISCLI_AUTH keeps the password out of shell history and ps. Redis 6 and later offer finer ACLs, with a user limited to a key prefix:

user app on >long-password ~app:* +@read +@write -@dangerous

Renaming FLUSHALL or CONFIG protects against mistakes but breaks some tools; weigh the trade-off. For a cache, data loss is often acceptable; for sessions or queues, it is not.

Persistence and memory

RDB writes periodic snapshots (save 900 1), AOF logs writes. For a cache, RDB is enough; for data you must keep, enable appendonly yes and test recovery. maxmemory and maxmemory-policy allkeys-lru prevent saturating VPS RAM. Redis is single-threaded: one slow command blocks all the others.

REDISCLI_AUTH='long-password' redis-cli BGSAVE
sudo ls -lh /var/lib/redis/dump.rdb

Copy dump.rdb off site, or use REDISCLI_AUTH='long-password' redis-cli --rdb for a direct transfer. Test the restore on a throwaway instance: an RDB file from another server does not always load without version checks.

Monitor and troubleshoot

INFO memory and INFO stats show memory pressure and evictions. Logs are in /var/log/redis/redis-server.log. NOAUTH means a missing password; OOM command not allowed means maxmemory is reached; Connection refused means a stopped service or wrong interface. Avoid long MONITOR sessions in production: they expose every command and slow the instance.