Key-value store Redis is renowned for its versatility, performance, and support of a wide range of languages and dialects.
Install, configure and secure Redis on an Ubuntu 18.04 server with this article.<\/p>\n\n\n\n
Prerequisites<\/strong><\/p>\n\n\n\n A non-root user with sudo capabilities and a basic firewall are required to finish this article. You can begin by logging into your Ubuntu 18.04 server as your sudo user and following the instructions provided below.<\/p>\n\n\n\n Step 1 \u2014 Installing and Configuring Redis<\/strong><\/p>\n\n\n\n Installing Redis from the official Ubuntu repositories using apt is the best way to get the most recent version.<\/p>\n\n\n\n If you haven’t recently updated your local apt package cache, do so now:<\/p>\n\n\n\n sudo apt update<\/strong><\/p>\n\n\n\n Then, type: Redis to install it.<\/p>\n\n\n\n sudo apt install Redis-server<\/strong><\/p>\n\n\n\n All the necessary software will be installed in this process, including Redis. Using your chosen text editor, open this file:<\/p>\n\n\n\n sudo nano \/etc\/redis\/redis.conf<\/strong><\/p>\n\n\n\n Locate the supervised directive in the file. \/etc<\/strong>\/redis\/redis.conf<\/strong><\/p>\n\n\n\n Now that you’ve made that one update to the Redis configuration file, you’re done. Save and close it. $ sudo systemctl restart redis.service<\/strong><\/p>\n\n\n\n Now that Redis is installed and configured, you may start using it. Step 2 \u2014 Testing Redis<\/strong><\/p>\n\n\n\n Make sure Redis is working as intended before making any more configuration changes, as you would with any freshly installed software. Ensure that the Redis service is up and operating by doing the following steps:<\/p>\n\n\n\n $ sudo systemctl status redis<\/strong><\/p>\n\n\n\n If the command is running without any errors, the output will look like this:<\/p>\n\n\n\n Since Redis is already active and configured to run every time the server boots, you can see that it’s already running and ready to go.<\/p>\n\n\n\n Most frequent Redis use cases benefit from this option. The command-line client can be used to verify that Redis is working properly.<\/p>\n\n\n\n Use the ping command at the following prompt to see if you’re connected:<\/p>\n\n\n\n 127. 0 . 0 . 1 : 6379 > ping<\/p>\n\n\n\n output : pong<\/p>\n\n\n\n As you can see, there’s still a working connection to the server. Type the following to get the value:<\/p>\n\n\n\n Your cached value can be retrieved as long as everything is running smoothly:<\/p>\n\n\n\n Having confirmed that you can retrieve the value, return to the shell by closing the Redis prompt.<\/p>\n\n\n\n Ultimately, we’ll see if data persists after restarting or shutting down Redis. Once you’ve reconnected with the command-line client, make that your test value is still there:<\/p>\n\n\n\n It is important that the value of your key remains accessible:<\/p>\n\n\n\n Once you’ve completed, re-enter the shell:<\/p>\n\n\n\n Redis is now fully operational and ready for you to utilise, as a result of this. Step 3 \u2014 Binding to localhost<\/strong><\/p>\n\n\n\n Redis, by default, may only be accessed from within the local network. Open the Redis configuration file and make the modifications to fix the problem: This line should be uncommented (remove the # if it is there).<\/p>\n\n\n\n \/etc\/redis\/redis.conf<\/strong><\/p>\n\n\n\n Close and save the file (CTRL + X, Y, ENTER) when you’re done.<\/p>\n\n\n\n Make sure that systemd is aware of your changes by restarting the service:<\/p>\n\n\n\n Locate the following line and remove the # if it appears:<\/p>\n\n\n\n \/etc\/redis\/redis.conf<\/strong><\/p>\n\n\n\n Close and save the file (CTRL + X, Y, ENTER) when you’re done.<\/p>\n\n\n\n Make sure that systemd is aware of your changes by restarting the service:<\/p>\n\n\n\n Using the netstat command, you can verify that this update has taken effect:<\/p>\n\n\n\n According to the Redis configuration file, the redis-server application is bound to localhost (127.0.0.1). It will be more difficult for bad actors to make requests or get access to your server now that your Redis installation is only listening in on localhost. Step 4 \u2014 Configuring a Redis Password<\/strong><\/p>\n\n\n\n The auth command, which requires clients to authenticate before accessing the database, can be enabled by configuring a Redis password, one of the two built-in security mechanisms. Look for a statement in the SECURITY section that reads:<\/p>\n\n\n\n \/etc\/redis\/redis.conf<\/strong><\/p>\n\n\n\n Remove the # and change foobared to a more safe password by uncommenting it.<\/p>\n\n\n\n Restart Redis after you’ve saved and closed the file and set the password:<\/p>\n\n\n\n Access the Redis command line and run the following command to verify that the password is correct.<\/p>\n\n\n\n Redis passwords can be tested using the following command sequence. In this case, Redis sends an error because you failed to authenticate.<\/p>\n\n\n\n The command prompt authenticates with the Redis configuration file’s password:<\/p>\n\n\n\n Redis acknowledges:<\/p>\n\n\n\n After that, the previous command will perform as planned:<\/p>\n\n\n\n obtain the queries for the first key1 Following authentication, you can exit the redis-cli and run commands in the Redis client:<\/p>\n\n\n\n The next topic we’ll cover is renaming Redis instructions, which, if executed maliciously or by accident, can do a lot of damage to your PC.<\/p>\n\n\n\n Step 5 \u2014 Renaming Dangerous Commands<\/strong><\/p>\n\n\n\n Renaming or deactivating hazardous instructions in Redis is another security tool embedded into the database server.<\/p>\n\n\n\n Such commands can be used by unauthorised users to alter, delete, or otherwise erase your data. Commands such as FLUSHDB and FLUSHALL are regarded dangerous, as are KEYS, PEXPIRE, DEL, CONFIG, SHUTDOWN, BGREWRITEAOF and SAVE. SPOP, SREM, RENAME and DEBUG are all considered risky. Whether or whether a command should be disabled or renamed depends on your personal or site-specific requirements. Redis commands can be enabled or disabled by reopening the Redis configuration file:<\/p>\n\n\n\n An empty string (two quote marks with no letters between them) is all that is needed to disable a command.<\/p>\n\n\n\n \/etc\/redis\/redis.conf<\/p>\n\n\n\n . . .<\/p>\n\n\n\n # This Redis installation will no longer be able to use FLUSHDB, FLUSHALL, or DEBUG if these directives are added and followed by empty strings.<\/p>\n\n\n\n You can rename a command by giving it a new name, such as the examples below. . . .<\/p>\n\n\n\n rename-command SHUTDOWN SHUTDOWN_MENOT Renaming the SHUTDOWN and CONFIG commands to SHUTDOWN MENOT and ASC12 CONFIG, respectively, is done in these instances.<\/p>\n\n\n\n Close the document and save your work.<\/p>\n\n\n\n After renaming a command, restart Redis to apply the change:<\/p>\n\n\n\n The Redis client can be used to see if these commands were successfully updated:<\/p>\n\n\n\n Then, authenticate:<\/p>\n\n\n\n In the prior example, you renamed the command CONFIG to ASC12 CONFIG. The renamed command, on the other hand, will work. Anyone who runs Redis’ config command can access the installation’s underlying configuration file.
You can do this by following the instructions in our Initial Server Setup guide.<\/p>\n\n\n\n
The Redis configuration file generated automatically following the installation has one critical configuration update to make.<\/p>\n\n\n\n
This directive allows you to specify an init system to manage Redis as a service, giving you greater control over its operation..
By default, the supervised directive is turned off.
Change this to systemd since you’re running Ubuntu, which makes use of the systemd init system:<\/p>\n\n\n\n
Restart Redis to take effect the modifications you made in the Redis configuration file:<\/p>\n\n\n\n
It’s a good idea to verify if Redis is working properly before employing it.<\/p>\n\n\n\n
In this section, we’ll cover a few strategies to ensure that Redis is functioning properly.<\/p>\n\n\n\nOutput\u25cf redis-server.service - Advanced key-value store\n Loaded: loaded (\/lib\/systemd\/system\/redis-server.service; enabled; vendor preset: enabled)\n Active: active (running) since Wed 2018-06-27 18:48:52 UTC; 12s ago\n Docs: http:\/\/redis.io\/documentation,\n man:redis-server(1)\n Process: 2421 ExecStop=\/bin\/kill -s TERM $MAINPID (code=exited, status=0\/SUCCESS)\n Process: 2424 ExecStart=\/usr\/bin\/redis-server \/etc\/redis\/redis.conf (code=exited, status=0\/SUCCESS)\n Main PID: 2445 (redis-server)\n Tasks: 4 (limit: 4704)\n CGroup: \/system.slice\/redis-server.service\n \u2514\u25002445 \/usr\/bin\/redis-server 127.0.0.1:6379<\/code><\/pre>\n\n\n\n
It’s also possible to configure a command to start Redis manually every time your server boots:<\/p>\n\n\n\n$ sudo systemctl disable redis<\/code><\/pre>\n\n\n\n$redis-cli<\/code><\/pre>\n\n\n\n
Next, see if you have the ability to set keys by performing the following command:<\/p>\n\n\n\n127 . 0 . 0 . 1 : 6379>set test \"It's working!\"\n<\/code><\/pre>\n\n\n\nOutputOK<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> get test<\/code><\/pre>\n\n\n\nOutput\"It's working!\"<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> exit<\/code><\/pre>\n\n\n\n
The first procedure is to restart Redis:<\/p>\n\n\n\n$ sudo systemctl restart redis<\/code><\/pre>\n\n\n\n$ redis-cli<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> get test<\/code><\/pre>\n\n\n\nOutput\"It's working!\"<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> exit<\/code><\/pre>\n\n\n\n
The problem is that certain of its default configuration settings are vulnerable to assault and unauthorised access to your server and its data, making it vulnerable to attack.
According to the official Redis website, these vulnerabilities can be mitigated via the following steps.
Redis will still function if you don’t follow these steps, however it is strongly suggested that you do so in order to increase the security of your system.<\/p>\n\n\n\n
You may have modified the Redis configuration file to accept connections from any IP address if you followed a guide other than this one.
Localhost binding is far more secure than this.<\/p>\n\n\n\n
<\/p>\n\n\n\n$ sudo nano \/etc\/redis\/redis.conf<\/code><\/pre>\n\n\n\nbind 127.0.0.1 ::1<\/code><\/pre>\n\n\n\n$ sudo systemctl restart redis<\/code><\/pre>\n\n\n\nbind 127.0.0.1 ::1<\/code><\/pre>\n\n\n\n$ sudo systemctl restart redis<\/code><\/pre>\n\n\n\n$ sudo netstat -lnp | grep redis<\/code><\/pre>\n\n\n\nOutputtcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 14222\/redis-server \ntcp6 0 0 ::1:6379 :::* LISTEN 14222\/redis-server \n<\/code><\/pre>\n\n\n\n
Check to make sure that you uncommented the proper line and restart the Redis service again if you see a different IP address (0.0.0.0, for example).<\/p>\n\n\n\n
In contrast to this, Redis does not currently enforce authentication before making changes to its configuration or the data it contains.
This can be remedied by requiring Redis client users to authenticate themselves with a password before making modifications (redis-cli).<\/p>\n\n\n\n
So open the Redis.conf file in your favourite text editor and type in the password you’d like to use to access Redis.<\/p>\n\n\n\n$ sudo nano \/etc\/redis\/redis.conf\n<\/code><\/pre>\n\n\n\n# requirepass foobared<\/code><\/pre>\n\n\n\n$ sudo systemctl restart redis.service\n<\/code><\/pre>\n\n\n\n$ redis-cli<\/code><\/pre>\n\n\n\n
Setting a key value before authentication is the first command’s goal.<\/p>\n\n\n\n127 . 0 . 0 . 1 : 6379> set key1 10<\/code><\/pre>\n\n\n\nOutput(error) NOAUTH Authentication required.<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> auth your_redis_password<\/code><\/pre>\n\n\n\nOutput\nOK<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> set key1 10<\/code><\/pre>\n\n\n\nOutput\nOK<\/code><\/pre>\n\n\n\n
The new key’s value can be found in Redis.<\/p>\n\n\n\n127 . 0 . 0 . 1 : 6379> get key1<\/code><\/pre>\n\n\n\nOutput\n\"10\"<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> quit<\/code><\/pre>\n\n\n\n
In the same SECURITY section of the \/etc\/redis\/redis.conf file, renaming or deactivating commands can be specified.<\/p>\n\n\n\n
Starting with renaming or deactivating all of the commands on that list is a smart place to begin improving the security of your Redis server.<\/p>\n\n\n\n
Disabling a command that could be misused if you know you won’t ever use it is fine.
As a result, renaming it may be in your best interests.<\/p>\n\n\n\n$ sudo nano \/etc\/redis\/redis.conf<\/code><\/pre>\n\n\n\nBy renaming a command, it is also possible to fully remove it from the system.<\/h2>\n\n\n\n
an empty string:<\/h2>\n\n\n\n
rename-command FLUSHDB “”
rename-command FLUSHALL “”
rename-command DEBUG “”
. . .<\/p>\n\n\n\n
A command’s name should be tough for others to decipher, yet simple for you to remember.<\/p>\n\n\n\nrename-command CONFIG “”<\/h2>\n\n\n\n
rename-command CONFIG ASC12_CONFIG
. . .<\/p>\n\n\n\n$ sudo systemctl restart redis.service\n<\/code><\/pre>\n\n\n\n$ redis-cli<\/code><\/pre>\n\n\n\n127 . 0 . 0 . 1 : 6379> auth your_redis_password<\/code><\/pre>\n\n\n\nOutput\nOK<\/code><\/pre>\n\n\n\n
Initially, you may want to use the original CONFIG command.
Because you’ve renamed it, it should fail:<\/p>\n\n\n\n127 . 0 . 0 . 1 : 6379> config get requirepass\n<\/code><\/pre>\n\n\n\nOutput\n(error) ERR unknown command 'config'\n<\/code><\/pre>\n\n\n\n
It doesn’t matter if it’s capitalised or lowercase:<\/p>\n\n\n\n127 . 0 . 0 . 1 : 6379> asc12_config get requirepass\n<\/code><\/pre>\n\n\n\n
In combination with get and a directive from the configuration file, the command will return that directive and its current value:.<\/p>\n\n\n\nOutput1) \"requirepass\"\n2) \"your_redis_password\"<\/code><\/pre>\n\n\n\n