Authentication with requirepass in Redis - Deep Dive

Overview - Authentication with requirepass

What is it?

Authentication with requirepass is a security feature in Redis that requires clients to provide a password before they can execute commands. This password is set in the Redis configuration file or at runtime. Without the correct password, Redis will refuse to process commands, protecting the data from unauthorized access. It is a simple way to add a layer of security to your Redis server.

Why it matters

Without authentication, anyone who can connect to your Redis server can read, modify, or delete your data. This can lead to data loss, leaks, or service disruption. Authentication with requirepass helps prevent unauthorized users from accessing your Redis data, especially in shared or public network environments. It is a basic but crucial step to keep your data safe and your applications reliable.

Where it fits

Before learning about requirepass, you should understand what Redis is and how it handles client connections. After mastering requirepass, you can explore more advanced Redis security features like TLS encryption, ACLs (Access Control Lists), and network-level protections.

Mental Model

Core Idea

Requirepass is like a locked door that only opens when you provide the correct key (password) before using Redis.

Think of it like...

Imagine Redis as a private library. The requirepass is the lock on the library door. Only people with the right key (password) can enter and read or borrow books (data). Without the key, the door stays shut, keeping the library safe.

┌───────────────┐
│ Redis Server  │
│  ┌─────────┐  │
│  │ require │  │
│  │ pass    │  │
│  └─────────┘  │
│       ▲       │
│       │       │
│  Client sends│
│  password    │
└───────┬───────┘
        │
   If password correct
        │
   ┌────▼─────┐
   │ Access   │
   │ granted  │
   └──────────┘

Build-Up - 7 Steps

1

Foundation

What is requirepass in Redis

Concept: Introduce the requirepass setting as a password requirement for Redis clients.

Redis has a configuration option called requirepass. When set, Redis asks clients to provide a password before allowing any commands. This password is a simple text string you choose and set in the redis.conf file or via command line. If a client does not authenticate with the correct password, Redis will reject commands.

Result

Clients must send the correct password to use Redis commands; otherwise, they get an error.

Understanding requirepass is the first step to securing Redis by controlling who can access it.

2

Foundation

How to set requirepass in Redis

Concept: Learn the practical way to enable requirepass by editing configuration or using commands.

To enable requirepass, open the redis.conf file and find the line starting with requirepass. Remove the # to uncomment it and set your password, for example: requirepass mysecretpassword. Then restart Redis to apply. Alternatively, you can run the command CONFIG SET requirepass mysecretpassword in a running Redis instance to set it temporarily.

Result

Redis now requires clients to authenticate with 'mysecretpassword' before accepting commands.

Knowing how to set requirepass lets you quickly add password protection to your Redis server.

3

Intermediate

How clients authenticate with requirepass

🤔Before reading on: Do you think clients send the password with every command or just once? Commit to your answer.

Concept: Clients must send the AUTH command with the password before running other commands.

When requirepass is set, clients must send AUTH as the first command after connecting. If the password is correct, Redis replies with OK and allows further commands. If wrong or missing, Redis replies with an error and ignores other commands. This means the password is sent once per connection, not with every command.

Result

Clients that authenticate successfully can use Redis normally; others get errors.

Understanding the AUTH command clarifies how Redis enforces password checks efficiently per connection.

4

Intermediate

What happens if authentication fails

🤔Before reading on: Do you think Redis disconnects clients immediately on wrong password or just rejects commands? Commit to your answer.

Concept: Redis rejects commands but keeps the connection open after failed authentication attempts.

If a client sends the wrong password or no password, Redis responds with an error like 'NOAUTH Authentication required.' However, it does not close the connection immediately. The client can try AUTH again. Only after successful AUTH will Redis accept commands. This behavior allows clients to retry but prevents unauthorized access.

Result

Unauthorized clients cannot run commands but remain connected until they authenticate or disconnect.

Knowing Redis keeps connections open after failed auth helps in debugging and designing client retry logic.

5

Intermediate

Limitations of requirepass authentication

Concept: Requirepass is a simple password check but has security limits.

Requirepass uses a single shared password for all clients, with no user differentiation. It sends the password in plain text, so if the network is not secure, attackers can intercept it. Also, it does not protect against network-level attacks or unauthorized connections if Redis is exposed publicly. For stronger security, Redis supports ACLs and TLS encryption.

Result

Requirepass provides basic protection but is not enough for sensitive or public deployments.

Understanding requirepass limits guides when to use more advanced Redis security features.

6

Advanced

Changing requirepass at runtime safely

🤔Before reading on: Do you think changing requirepass at runtime disconnects clients or applies immediately? Commit to your answer.

Concept: You can change requirepass without restarting Redis, but it affects new connections only.

Using CONFIG SET requirepass changes the password immediately for new connections. Existing clients authenticated with the old password remain connected and authorized until they disconnect. This means changing the password does not kick out current clients, which can be a security consideration. To enforce new passwords, you must restart Redis or disconnect clients manually.

Result

Password changes apply immediately for new clients but not for existing ones.

Knowing this behavior helps plan secure password rotations without service disruption.

7

Expert

Security implications of requirepass in production

🤔Before reading on: Do you think requirepass alone is enough for production security? Commit to your answer.

Concept: Requirepass is a basic security measure but should be combined with other controls in production.

In production, relying only on requirepass is risky because it uses a single password and sends it unencrypted. Experts combine requirepass with network-level protections like firewalls, bind directives to limit IP access, and enable TLS encryption to protect password transmission. Additionally, Redis ACLs allow fine-grained user permissions beyond requirepass. Monitoring and logging authentication attempts is also critical to detect attacks.

Result

Requirepass is part of a layered security approach, not a standalone solution.

Understanding requirepass's role in a security stack prevents overconfidence and encourages best practices.

Under the Hood

When requirepass is set, Redis stores the password in memory. Upon client connection, Redis marks the client as unauthenticated. When the client sends AUTH , Redis compares the given password with the stored one. If they match, Redis marks the client as authenticated and allows commands. Otherwise, it rejects commands with an error. Redis does not encrypt the password; it relies on the transport layer for security. The authentication state is tracked per client connection internally.

Why designed this way?

Requirepass was designed as a simple, lightweight way to add access control without complex user management. It fits Redis's philosophy of speed and simplicity. More complex authentication and authorization were added later as ACLs. The plain-text password and per-connection auth reflect Redis's early focus on trusted environments and performance over heavy security.

┌───────────────┐
│ Client connects│
└───────┬───────┘
        │
        ▼
┌─────────────────────┐
│ Client marked as     │
│ unauthenticated     │
└─────────┬───────────┘
          │
          ▼
┌─────────────────────┐
│ Client sends AUTH    │
│ with password        │
└─────────┬───────────┘
          │
          ▼
┌─────────────────────────────┐
│ Redis compares password      │
│ with stored requirepass      │
└─────────┬───────────────────┘
          │
   ┌──────┴───────┐
   │              │
   ▼              ▼
┌───────────┐  ┌───────────────┐
│ Match     │  │ No match      │
│ Auth OK   │  │ Reject command│
└───────────┘  └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does setting requirepass encrypt the password over the network? Commit yes or no.

Common Belief: Setting requirepass encrypts the password so it is safe over any network.

Reality: Requirepass does not encrypt the password; it is sent in plain text over the network.

Why it matters: If Redis is exposed on an insecure network, attackers can intercept the password and gain full access.

Quick: Does requirepass create multiple user accounts with different permissions? Commit yes or no.

Common Belief: Requirepass allows multiple users with different passwords and permissions.

Reality: Requirepass uses a single shared password for all clients; it does not support multiple users or permissions.

Why it matters: This limits security granularity and can lead to over-permissioned access if shared widely.

Quick: If a client fails authentication, does Redis disconnect it immediately? Commit yes or no.

Common Belief: Redis disconnects clients immediately after a failed AUTH attempt.

Reality: Redis keeps the connection open after failed authentication, allowing clients to retry AUTH.

Why it matters: Clients may remain connected but unable to run commands, which can confuse debugging or allow brute force attempts.

Quick: Does changing requirepass at runtime disconnect existing clients? Commit yes or no.

Common Belief: Changing requirepass immediately disconnects all clients using the old password.

Reality: Existing authenticated clients remain connected; the new password applies only to new connections.

Why it matters: This can cause security gaps during password rotation if old clients stay connected.

Expert Zone

1

Requirepass authentication state is tracked per TCP connection, so reconnecting requires re-authentication.

2

Changing requirepass at runtime does not invalidate existing client sessions, which can be a security risk if not managed.

3

Requirepass does not protect against replay attacks or man-in-the-middle; combining with TLS is essential for secure deployments.

When NOT to use

Requirepass is not suitable for multi-user environments or where fine-grained access control is needed. Instead, use Redis ACLs introduced in Redis 6, which support multiple users with different passwords and permissions. For secure network communication, always use TLS encryption alongside authentication.

Production Patterns

In production, requirepass is often combined with network-level restrictions like binding Redis to localhost or private networks, firewall rules, and TLS encryption. ACLs are used for user management. Passwords are rotated carefully, and monitoring tools track failed authentication attempts to detect attacks.

Connections

Access Control Lists (ACLs)

Builds-on

Understanding requirepass helps grasp why ACLs were introduced to provide more flexible and secure user management in Redis.

TLS Encryption

Complementary security

Knowing requirepass's lack of encryption highlights the importance of TLS to protect passwords and data in transit.

Network Firewalls

Layered security

Requirepass is one layer of defense; combining it with firewalls limits who can connect, enhancing overall security.

Common Pitfalls

#1 Setting requirepass but forgetting to restart Redis or reload config.

Wrong approach:

Edit redis.conf to add 'requirepass mypassword' but do not restart Redis.

Correct approach:

After editing redis.conf, restart Redis server to apply the new password setting.

Root cause:

Redis reads requirepass only at startup; changes in config file do not apply until restart.

#2 Trying to authenticate with AUTH command after already authenticated.

Wrong approach:

Sending AUTH mypassword multiple times during the same connection.

Correct approach:

Send AUTH only once per connection; subsequent commands do not require AUTH again.

Root cause:

Misunderstanding that authentication is per connection, not per command.

#3 Exposing Redis with requirepass on public network without TLS.

Wrong approach:

Running Redis with requirepass but no encryption on a public IP.

Correct approach:

Use TLS encryption or VPN to secure Redis traffic when exposed publicly, not just requirepass.

Root cause:

Assuming password alone protects data in transit, ignoring network sniffing risks.

Key Takeaways

Requirepass adds a simple password check to Redis, blocking unauthorized commands until clients authenticate.

Clients must send the AUTH command with the correct password once per connection to gain access.

Requirepass sends passwords in plain text and uses a single shared password, so it is not enough alone for strong security.

Changing requirepass at runtime affects new connections only; existing clients remain authenticated until disconnect.

In production, requirepass should be combined with ACLs, TLS encryption, and network controls for robust security.