Restrict dangerous Redis commands with ACLs

The fix/etc/redis/redis.conf

user app on >YOUR_SECRET ~app:* &* +@all -@dangerous -@admin

Or against a running server, without a restart:

redis-cli ACL SETUSER app on '>YOUR_SECRET' '~app:*' '&*' +@all -@dangerous -@admin
redis-cli CONFIG REWRITE

Why it matters

A handful of Redis commands do far more than read and write keys:

• FLUSHALL / FLUSHDB erase the dataset in one call, with no confirmation.
• CONFIG SET changes the working directory and dump filename at runtime, which is what turns Redis access into arbitrary file writes and then code execution.
• MODULE LOAD loads a shared library — code execution by design.
• REPLICAOF / SLAVEOF repoints the instance at an attacker’s server.
• DEBUG does things no application needs.
• KEYS blocks the server while it scans everything — a denial of service from a single careless call.

An application almost never needs any of them. Removing them costs nothing and takes the worst outcomes off the table even if the credential leaks.

rename-command is deprecated — this is the part most guides get wrong

Search for Redis hardening and you will be told to do this:

# Do not do this.
rename-command FLUSHALL ""
rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52

Redis’s own documentation now marks that method deprecated, stating it “may be removed in future versions” and that you should “use ACL rules to disallow specific commands” instead.

It is worth understanding why, because the reasoning outlives the directive:

• It is server-wide. Renaming CONFIG removes it from your admin tooling and your monitoring too, not just from the application. ACLs are per-user, so the app loses CONFIG while an admin user keeps it.
• It needs a restart to change, whereas ACL SETUSER takes effect immediately.
• Renaming to an unguessable string is obscurity. The command still exists; anyone who reads your config has it.
• It breaks clients and libraries that reasonably expect standard command names.

If you inherit a config using rename-command, it still works today. Treat it as technical debt with a deprecation notice attached, and migrate it to ACL rules.

Categories beat listing commands

Redis groups commands into categories, so you can deny a class rather than maintain a list that goes stale with every release:

+@all -@dangerous -@admin

Don’t take anyone’s word for what a category contains — including this page. Ask your server, because membership varies across versions:

redis-cli ACL CAT dangerous
redis-cli ACL CAT admin

Two things commonly surprise people: KEYS is in @dangerous (it’s there for the performance reason above, not a security one), and so is SHUTDOWN. If your application legitimately needs one command from a denied category, add it back explicitly rather than reopening the category:

+@all -@dangerous +keys

Verify it worked

Check the effective rule for the user:

redis-cli ACL GETUSER app

Then prove the denial rather than trusting the rule — authenticate as the app user and try:

redis-cli -u redis://app:SECRET@127.0.0.1:6379 CONFIG GET dir

Expect:

NOPERM ... has no permissions to run the 'config|get' command

If it returns a path, the rule is not effective — the usual cause is a later +@all overriding an earlier -@dangerous. Rules apply in order, so the last one wins.

Confirm nothing else re-granted it:

redis-cli ACL LIST

Before you apply this

Denying a category your application actually uses is an immediate outage, and the failure is a NOPERM error deep in your client library rather than anything obvious.

Find out what your app really calls before you restrict it. On a staging instance, watch live traffic:

redis-cli MONITOR

(MONITOR is itself in @admin and costs performance — use it on staging, not production, and never leave it running.)

Then check the denials after you apply the rule:

redis-cli ACL LOG

ACL LOG records every rejected command with the user and the reason. It is the fastest way to find the one command you didn’t know your app used — check it before you decide the change was clean.

Related

• Require authentication with ACL users — the user these rules attach to.
• Redis exposed to the internet — what CONFIG SET enables.