Redis

Redis is a high-performance in-memory key-value database widely used for caching, session management, message queues, and more. This article covers Redis installation, core configuration, service management, command-line tool usage, persistence strategies, and security hardening.

Versions Across Distributions

Live version data by pkgseek.com

Install Redis

Install from System Repository (EL 9)

The EL 9 AppStream repository includes Redis:

sudo dnf install redis -y

Redis is no longer shipped in EL 10 official repositories (it shows as — in the version comparison above). The official replacement is the compatible Valkey:

sudo dnf install valkey -y

If you must run Redis itself, install it from the Remi repository below. Note that service names and CLI tools change with the package name (Valkey uses valkey).

Using the Remi Repository (for Latest Version)

To install the latest stable version of Redis:

sudo dnf install epel-release -y
sudo dnf install https://rpms.remirepo.net/enterprise/remi-release-$(rpm -E %{rhel}).rpm -y

sudo dnf module reset redis -y
sudo dnf module enable redis:remi-7.2 -y
sudo dnf install redis -y

EL 10 no longer distributes modular content and the dnf module command is deprecated (it still exists but prints a warning). So do not copy the EL 8/9 redis:remi-x.y stream pattern, and do not use package names like redis7 / redis8 — Remi’s actual package names/streams on EL 10 change with its packaging, and hardcoding one gives No match:

# EL 10: check the package names Remi actually provides, then install
sudo dnf search redis
sudo dnf --enablerepo=remi list available 'redis*'
# install using the real package name listed above (placeholder — do not copy)
sudo dnf install <package-listed-above> -y

Start the Service

sudo systemctl start redis
sudo systemctl enable redis
sudo systemctl status redis

Verify that Redis is running properly:

redis-cli ping

If it returns PONG, Redis is running correctly.

Core Configuration

The main Redis configuration file is located at /etc/redis/redis.conf (on some systems, /etc/redis.conf).

redis-cli CONFIG GET dir
find /etc -name "redis.conf" 2>/dev/null

Back up the configuration before making changes:

sudo cp /etc/redis/redis.conf /etc/redis/redis.conf.bak

Bind Address

By default, Redis only listens on 127.0.0.1, which is the most secure setting.

grep "^bind" /etc/redis/redis.conf

If you need Redis to accept connections from a specific network:

sudo sed -i 's/^bind 127.0.0.1.*/bind 127.0.0.1 192.168.1.10/' /etc/redis/redis.conf

Note: Never bind Redis directly to 0.0.0.0 and expose it to the public internet. Redis is not designed to be directly internet-facing.

Set a Password (requirepass)

A password must be set in production environments:

sudo sed -i 's/^# requirepass foobared/requirepass YourStrongRedisPassword!/' /etc/redis/redis.conf

Or add it directly to the configuration file:

echo 'requirepass YourStrongRedisPassword!' | sudo tee -a /etc/redis/redis.conf

Connecting with a password:

redis-cli -a YourStrongRedisPassword!

# Or connect first then authenticate
redis-cli
# Once connected, run: AUTH YourStrongRedisPassword!

Change the Port

sudo sed -i 's/^port 6379/port 6380/' /etc/redis/redis.conf

Set Maximum Memory

Limit the maximum memory Redis can use and the eviction policy when memory is full:

sudo tee -a /etc/redis/redis.conf << 'EOF'

# Maximum memory limit
maxmemory 256mb

# Memory eviction policy
# allkeys-lru: Evict the least recently used key from all keys
# volatile-lru: Evict only from keys with an expiration set
# noeviction: Do not evict; return errors on writes when memory is full
maxmemory-policy allkeys-lru
EOF

Apply Configuration Changes

sudo systemctl restart redis

systemctl Service Management

# Start Redis
sudo systemctl start redis

# Stop Redis
sudo systemctl stop redis

# Restart Redis
sudo systemctl restart redis

# Check status
sudo systemctl status redis

# Enable at boot
sudo systemctl enable redis

# Disable at boot
sudo systemctl disable redis

# View Redis logs
sudo journalctl -u redis -f

View Redis Runtime Information

redis-cli INFO

# View specific sections
redis-cli INFO server
redis-cli INFO memory
redis-cli INFO clients
redis-cli INFO stats

redis-cli Basic Operations

redis-cli is the Redis command-line client tool.

String Operations

redis-cli

# Set key-value pairs
SET name "CentOS Fan"
SET counter 100

# Get values
GET name
GET counter

# Set with expiration (seconds)
SET session:abc123 "user_data" EX 3600

# Check remaining TTL
TTL session:abc123

# Increment/Decrement
INCR counter
DECR counter
INCRBY counter 10

Hash Operations

# Set hash fields
HSET user:1 name "Zhang San" email "[email protected]" age 30

# Get a single field
HGET user:1 name

# Get all fields and values
HGETALL user:1

# Delete a field
HDEL user:1 age

List Operations

# Push from the left
LPUSH queue "task1" "task2" "task3"

# Pop from the right
RPOP queue

# View list contents
LRANGE queue 0 -1

# List length
LLEN queue

Set Operations

# Add members
SADD tags "linux" "centos" "redis"

# View all members
SMEMBERS tags

# Check if a member exists
SISMEMBER tags "linux"

# Set size
SCARD tags

Key Management

# View all keys (use with caution in production)
KEYS *

# Use SCAN for safe iteration (recommended)
SCAN 0 MATCH "user:*" COUNT 10

# Check if a key exists
EXISTS name

# Delete a key
DEL name

# Set expiration time
EXPIRE counter 300

# Check data type of a key
TYPE counter

# View total number of keys in the database
DBSIZE

# Flush current database (dangerous)
# FLUSHDB

# Flush all databases (extremely dangerous)
# FLUSHALL

RDB and AOF Persistence

Redis provides two persistence methods that can be used individually or together.

RDB Snapshots

RDB writes in-memory data snapshots to disk at specified intervals. The files are compact and fast to restore, but data after the last snapshot may be lost.

grep -n "^save\|^dbfilename\|^dir" /etc/redis/redis.conf

Default RDB rules in the configuration file:

# At least 1 key modified within 3600 seconds
save 3600 1
# At least 100 keys modified within 300 seconds
save 300 100
# At least 10000 keys modified within 60 seconds
save 60 10000

# RDB file name
dbfilename dump.rdb

# RDB file storage directory
dir /var/lib/redis

Manually trigger an RDB snapshot:

# Blocking method (not recommended for production)
redis-cli SAVE

# Background async method (recommended)
redis-cli BGSAVE

# Check last snapshot time
redis-cli LASTSAVE

AOF Append-Only Log

AOF (Append Only File) records every write command, providing higher data safety but larger file sizes.

sudo sed -i 's/^appendonly no/appendonly yes/' /etc/redis/redis.conf

AOF sync policy configuration:

# always - Sync on every write command, safest but slowest
# everysec - Sync once per second (recommended, balances performance and safety)
# no - Let the OS decide when to sync
appendfsync everysec

AOF rewrite (compaction) configuration:

# Trigger rewrite when AOF file grows 100% beyond the size after last rewrite
auto-aof-rewrite-percentage 100
# Minimum 64MB AOF file size to trigger rewrite
auto-aof-rewrite-min-size 64mb

Manually trigger AOF rewrite:

redis-cli BGREWRITEAOF

Enable Both RDB and AOF (Recommended)

sudo tee -a /etc/redis/redis.conf << 'EOF'

# Enable AOF
appendonly yes
appendfsync everysec

# Keep default RDB configuration
# Redis prioritizes AOF for data recovery on restart (as AOF data is more complete)
EOF

sudo systemctl restart redis

Back Up Redis Data

sudo tee /usr/local/bin/redis-backup.sh << 'SCRIPT'
#!/bin/bash
BACKUP_DIR="/backup/redis"
DATE=$(date +%Y%m%d_%H%M%S)
REDIS_DATA="/var/lib/redis"
RETENTION_DAYS=7

mkdir -p "$BACKUP_DIR"

# Trigger RDB snapshot
redis-cli BGSAVE
sleep 5

# Copy the RDB file
cp "${REDIS_DATA}/dump.rdb" "${BACKUP_DIR}/dump_${DATE}.rdb"

# If AOF is enabled, archive the whole appendonlydir (Redis 7+ uses multi-part AOF: manifest + base + incr)
if [ -d "${REDIS_DATA}/appendonlydir" ]; then
    tar -czf "${BACKUP_DIR}/appendonly_${DATE}.tgz" -C "${REDIS_DATA}" appendonlydir
fi

# Clean up old backups
find "$BACKUP_DIR" -name "*.rdb" -mtime +${RETENTION_DAYS} -delete
find "$BACKUP_DIR" -name "*.aof" -mtime +${RETENTION_DAYS} -delete

echo "Redis backup completed: ${BACKUP_DIR}"
SCRIPT

sudo chmod +x /usr/local/bin/redis-backup.sh

Security Hardening

Set a Strong Password

This was covered in the “Set a Password” section above. The importance is worth emphasizing again: Redis executes commands extremely fast, making weak passwords very easy to brute-force.

redis-cli CONFIG GET requirepass

Disable Dangerous Commands

Some commands pose significant risks in production and can be disabled by renaming them to an empty string:

sudo tee -a /etc/redis/redis.conf << 'EOF'

# Disable dangerous commands
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""
rename-command CONFIG "REDIS_CONFIG_b4f2e8a1"
EOF

Note: After disabling the CONFIG command, you must use the renamed version to execute it. Use this configuration with caution in Sentinel and Cluster modes.

Limit Client Connections

sudo sed -i 's/^# maxclients 10000/maxclients 5000/' /etc/redis/redis.conf

Protected Mode Notes

Redis has protected-mode enabled by default, which rejects external connections when no password is set and the bind address is not 127.0.0.1. Always keep this option enabled:

grep "^protected-mode" /etc/redis/redis.conf

Configure the Firewall

If Redis needs to accept remote connections, access sources must be restricted through the firewall:

# Allow only a specific IP
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port port="6379" protocol="tcp" accept'
sudo firewall-cmd --reload

Do not open the Redis port to all sources:

# Not recommended! Do not open the Redis port to everyone
# sudo firewall-cmd --permanent --add-port=6379/tcp

Run as a Non-Privileged User

By default, Redis already runs as the redis user. You can confirm this:

ps aux | grep redis-server

Security Checklist

Use the following commands to quickly check Redis security status:

echo "=== Bind Address ==="
redis-cli CONFIG GET bind

echo "=== Password Setting ==="
redis-cli CONFIG GET requirepass

echo "=== Protected Mode ==="
redis-cli CONFIG GET protected-mode

echo "=== Listening Port ==="
redis-cli CONFIG GET port

echo "=== Maximum Memory ==="
redis-cli CONFIG GET maxmemory

echo "=== Connected Clients ==="
redis-cli INFO clients | grep connected_clients

Common Operations Quick Reference

# Start / Stop / Restart
sudo systemctl start redis
sudo systemctl stop redis
sudo systemctl restart redis

# Connect to Redis
redis-cli
redis-cli -a password
redis-cli -h host -p port -a password

# View Redis version
redis-server --version

# Monitor all commands in real time (for debugging, use with caution in production)
redis-cli MONITOR

# View slow query log
redis-cli SLOWLOG GET 10

# View memory usage
redis-cli INFO memory

# View memory usage of a specific key
redis-cli MEMORY USAGE keyname

# Modify configuration at runtime (no restart needed)
redis-cli CONFIG SET maxmemory 512mb
redis-cli CONFIG SET maxmemory-policy allkeys-lru

# Write runtime configuration to the configuration file
redis-cli CONFIG REWRITE