Skip to content
IT // Adventures

Redis Installation on Debian

A Redis 3.2 demo installation on Debian 9.

2 min read
Contents

For a new project, I’m currently taking a look at the in-memory database Redis. The demo installation described in this post runs on a minimal Debian 9 lab system and uses Redis 3.2 from the default repo.

Installation and basic configuration

The Redis server package has hardly any dependencies, so installing it from the Debian repo is very easy:

apt install redis-server redis-tools libjemalloc1

For Redis to work as a daemon with systemd, the “supervised” directive has to be adjusted in the configuration file /etc/redis/redis.conf:

supervised systemd

Then (re)start the Redis server:

systemctl restart redis

Test the Redis installation

To test the basic function of Redis, I use both the Redis CLI and the Python module. The latter first has to be installed with:

apt install python-redis

To test, we use the Redis CLI to create the key “hello” with the value “world”…

$ redis-cli
127.0.0.1:6379> set hello "world"
OK
127.0.0.1:6379> exit
... and then read it back via Python:

Python 2.7.13 (default, Sep 26 2018, 18:42:22)
[GCC 6.3.0 20170516] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import redis
>>> conn = redis.Redis()
>>> conn.get('hello')
'world'

Redis Security

Redis is designed as an internal database and therefore offers only a handful of “basic features” to secure the installation. If Redis traffic has to cross public networks, an SSL proxy is practically a must.

More information on security: https://redis.io/topics/security and http://antirez.com/news/96

Set an auth password

So that not every client that can reach the Redis service can read/write data, setting the requirepass directive in the configuration file /etc/redis/redis.conf is definitely “best practice”:

# Warning: since Redis is pretty fast an outside user can try up to
# 150k passwords per second against a good box. This means that you should
# use a very strong password otherwise it will be very easy to break.
requirepass cf9b752e021dda9da9f0b4f009ddd7a5fbb337072e23d6bd8a228a42dbbdbf99

You should take the warning in the configuration file seriously, as Redis doesn’t come with any protection against brute-force attacks either.

Disable dangerous commands

The second essential security feature is renaming or disabling “dangerous” commands. One example is the CONFIG command, which should never be run by a normal Redis client. Other commands would be e.g. FLUSHDB, FLUSHALL and SHUTDOWN.

With the rename-command directive in /etc/redis/redis.conf, the commands can be renamed (security by obscurity!) or disabled:

# It is also possible to completely kill a command by renaming it into
# an empty string:
rename-command CONFIG ""
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""
rename-command SHUTDOWN SHUTDOWN_fa1edda8d5

Sources