Redis Security Agent

Overview

Production-grade agent for Redis security hardening. Expert guidance on authentication, Access Control Lists (ACL), TLS encryption, network security, and compliance requirements.

Security Maturity Levels

┌─────────────────────────────────────────────────────────────────────┐
│                    SECURITY LEVEL MATRIX                            │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Level 1: Basic (Development)                                       │
│  ├── Password authentication                                        │
│  └── Localhost binding                                              │
│                                                                     │
│  Level 2: Standard (Internal Production)                            │
│  ├── Strong password                                                │
│  ├── ACL with role-based access                                     │
│  ├── Private network only                                           │
│  └── Dangerous command disabled                                     │
│                                                                     │
│  Level 3: Hardened (External/Sensitive)                             │
│  ├── TLS encryption                                                 │
│  ├── Certificate-based auth                                         │
│  ├── Audit logging                                                  │
│  └── Key rotation policy                                            │
│                                                                     │
│  Level 4: Compliance (PCI-DSS, HIPAA)                               │
│  ├── All of Level 3                                                 │
│  ├── Encryption at rest                                             │
│  ├── Regular security scans                                         │
│  └── Documented procedures                                          │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

1. Authentication

Password Authentication (Legacy)

# redis.conf
requirepass "your-strong-password-here-min-32-chars"

# Connect with auth
redis-cli -a "your-password"
redis-cli AUTH "your-password"

# Check auth status
redis-cli PING  # Returns PONG if authenticated

ACL System (Redis 6.0+)

# Default admin user
ACL SETUSER default on >password ~* &* +@all

# Create application user (limited)
ACL SETUSER appuser on >app-secret ~app:* +@read +@write -@dangerous

# Create read-only user
ACL SETUSER readonly on >readonly-secret ~* +@read -@write

# Create admin user
ACL SETUSER admin on >admin-secret ~* &* +@all

ACL Rule Syntax

ACL SETUSER <username>
  [on|off]                    # Enable/disable user
  [>password]                 # Add password
  [#hash]                     # Add password hash
  [~pattern]                  # Key pattern access
  [&channel]                  # Pub/Sub channel access
  [+command|-command]         # Allow/deny command
  [+@category|-@category]     # Allow/deny command category

ACL Categories

Category	Commands	Typical Use
@read	GET, MGET, HGET, etc.	Read-only apps
@write	SET, DEL, HSET, etc.	Read-write apps
@admin	CONFIG, DEBUG, etc.	Administrators
@dangerous	KEYS, FLUSHALL, etc.	Never for apps
@slow	O(N) commands	Avoid in prod
@pubsub	SUBSCRIBE, PUBLISH	Messaging apps

ACL Best Practices

# /etc/redis/users.acl

# Admin (full access, specific IP recommended)
user admin on >$(ADMIN_PASSWORD) ~* &* +@all

# Application (specific keys, no dangerous commands)
user appuser on >$(APP_PASSWORD) ~app:* ~cache:* +@read +@write -@dangerous -KEYS -FLUSHALL -FLUSHDB -DEBUG

# Monitoring (read-only INFO and PING)
user monitor on >$(MONITOR_PASSWORD) ~* +INFO +PING +CLIENT|ID +SLOWLOG|GET

# Replication (for replicas)
user replication on >$(REPL_PASSWORD) +PSYNC +REPLCONF +PING

2. TLS Encryption

Certificate Generation

# Generate CA
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt \
  -subj "/CN=Redis CA"

# Generate server certificate
openssl genrsa -out redis.key 2048
openssl req -new -key redis.key -out redis.csr \
  -subj "/CN=redis-server"
openssl x509 -req -in redis.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out redis.crt -days 365 -sha256

# Generate client certificate (optional)
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr \
  -subj "/CN=redis-client"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out client.crt -days 365 -sha256

TLS Configuration

# redis.conf
port 0                              # Disable non-TLS
tls-port 6379                       # TLS port
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt

# Require client certificates (optional, high security)
tls-auth-clients yes

# Cipher suites (TLS 1.2+)
tls-protocols "TLSv1.2 TLSv1.3"
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

# For replication
tls-replication yes
tls-cluster yes

TLS Client Connection

# CLI with TLS
redis-cli --tls \
  --cert /path/to/client.crt \
  --key /path/to/client.key \
  --cacert /path/to/ca.crt \
  -h redis-server -p 6379

# Verify TLS
redis-cli --tls --cacert ca.crt INFO server | grep tcp_port

3. Network Security

Binding & Exposure

# redis.conf

# Localhost only (development)
bind 127.0.0.1 -::1

# Private network
bind 10.0.0.5 127.0.0.1

# All interfaces (requires other protections!)
bind 0.0.0.0

# Protected mode (rejects external without auth)
protected-mode yes

Firewall Rules

# iptables - Allow only app servers
iptables -A INPUT -p tcp --dport 6379 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP

# UFW
ufw allow from 10.0.1.0/24 to any port 6379

# Security group (AWS)
# Inbound: TCP 6379 from app-server-sg

Disable Dangerous Commands

# redis.conf - Rename dangerous commands
rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command DEBUG ""
rename-command CONFIG "CONFIG_b840fc02d524045429"
rename-command SHUTDOWN "SHUTDOWN_b840fc02d524045429"
rename-command KEYS ""

# Or use ACL (preferred in Redis 6.0+)
ACL SETUSER default -FLUSHALL -FLUSHDB -DEBUG -KEYS

4. Security Hardening Checklist

## Network Layer
□ Bind to specific IP (not 0.0.0.0)
□ Enable protected-mode
□ Configure firewall rules
□ Use private network/VPC
□ Disable Redis port on public interfaces

## Authentication
□ Strong password (32+ chars, random)
□ Use ACL system (Redis 6.0+)
□ Separate users per application
□ No default user with full access
□ Regular password rotation

## Encryption
□ TLS enabled for client connections
□ TLS for replication traffic
□ TLS for cluster bus (if applicable)
□ Strong cipher suites only
□ Regular certificate rotation

## Command Security
□ Dangerous commands disabled/renamed
□ KEYS command disabled
□ DEBUG commands disabled
□ CONFIG restricted to admins

## Monitoring
□ Failed auth attempt alerts
□ Connection spike detection
□ Command audit logging
□ Anomaly detection

## Compliance
□ Encryption at rest (disk-level)
□ Regular security assessments
□ Documented access procedures
□ Incident response plan

Related Skills

redis-security - Security patterns (PRIMARY_BOND)
redis-production - Production hardening

Troubleshooting Guide

Common Issues & Solutions

1. NOAUTH Error

NOAUTH Authentication required

Fix:

# Provide password
redis-cli -a "your-password"

# Or authenticate after connect
redis-cli
AUTH your-password

2. NOPERM Error

NOPERM this user has no permissions to run the 'config' command

Diagnosis:

# Check current user
redis-cli ACL WHOAMI

# Check user permissions
redis-cli ACL GETUSER username