Protected mode in Redis - Step-by-Step Execution

Concept Flow - Protected mode

Redis Server Starts

↓

Check Protected Mode Setting

↓

Bind to localhost

↓

Accept only local

↓

connections

↓

Wait for Client Commands

When Redis starts, it checks if protected mode is on. If yes, it only accepts local connections to keep safe. If no, it accepts connections from anywhere.

Execution Sample

Redis

redis-server --protected-mode yes
# Server starts in protected mode
# Binds only to localhost
# Rejects remote connections

This starts Redis with protected mode enabled, so it only accepts connections from the local machine.

Execution Table

Step	Action	Protected Mode	Bind Address	Connection Allowed	Reason
1	Start Redis Server	Yes	127.0.0.1	Yes	Protected mode enabled, binds localhost only
2	Client tries local connection	Yes	127.0.0.1	Yes	Local connection allowed
3	Client tries remote connection	Yes	127.0.0.1	No	Remote connections blocked in protected mode
4	Restart Redis with protected mode no	No	0.0.0.0	Yes	Binds all interfaces, accepts remote
5	Client tries remote connection	No	0.0.0.0	Yes	Remote connection allowed
6	Client tries local connection	No	0.0.0.0	Yes	Local connection allowed
7	Server stops	No	-	-	Server shutdown

💡 Execution stops when server shuts down or no more connection attempts

Variable Tracker

Variable	Start	After Step 1	After Step 4	Final
protected_mode	undefined	Yes	No	No
bind_address	undefined	127.0.0.1	0.0.0.0	0.0.0.0
connection_allowed_local	undefined	Yes	Yes	Yes
connection_allowed_remote	undefined	No	Yes	Yes

Key Moments - 3 Insights

Why does Redis reject remote connections when protected mode is enabled?

Because in protected mode Redis binds only to localhost (127.0.0.1), so remote clients cannot connect. See execution_table row 3.

What changes when protected mode is disabled?

Redis binds to all network interfaces (0.0.0.0) and accepts remote connections. See execution_table rows 4 and 5.

Can local connections be made when protected mode is enabled?

Yes, local connections are allowed because Redis binds to localhost. See execution_table row 2.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does Redis start accepting remote connections?

A Step 5

B Step 2

C Step 3

D Step 6

💡 Hint

Check the 'Connection Allowed' column for remote connections in execution_table rows.

According to variable_tracker, what is the bind_address after step 1?

A 0.0.0.0

B 127.0.0.1

C localhost

D undefined

💡 Hint

Look at the 'bind_address' row and 'After Step 1' column in variable_tracker.

If protected_mode was set to 'No' from the start, what would be the connection_allowed_remote value after step 1?

A Undefined

B No

C Yes

D Depends on client

💡 Hint

Refer to variable_tracker 'connection_allowed_remote' values and execution_table step 4.

Concept Snapshot

Protected mode in Redis:
- Enabled by default for safety
- Binds Redis to localhost (127.0.0.1)
- Blocks remote connections
- Disable to allow remote access (bind 0.0.0.0)
- Prevents accidental exposure of Redis server

Full Transcript

When Redis server starts, it checks if protected mode is enabled. If yes, it binds only to localhost (127.0.0.1) and accepts connections only from the local machine. This blocks any remote connection attempts to protect the server from unauthorized access. If protected mode is disabled, Redis binds to all network interfaces (0.0.0.0) and accepts connections from remote clients. Local connections are always allowed. This behavior helps keep Redis safe by default and requires explicit action to expose it remotely.

Practice

1. What is the main purpose of Redis protected-mode?

easy

A. To increase Redis performance by caching data

B. To limit connections and keep Redis safe by default

C. To enable automatic backups of Redis data

D. To allow unlimited remote connections without restrictions

Solution

1. Step 1: Understand what protected mode does

   Protected mode is designed to keep Redis safe by limiting who can connect to it.

2. Step 2: Identify the main purpose

   It prevents unauthorized access by restricting connections unless properly configured.

3. Final Answer:

   To limit connections and keep Redis safe by default -> Option B

4. Quick Check:

   Protected mode = Limits connections [OK]

Hint: Protected mode restricts connections to protect Redis [OK]

Common Mistakes:

• Thinking it improves performance
• Confusing it with backup features
• Assuming it allows open access

2. Which of the following is the correct way to disable protected mode in the Redis configuration file?

easy

A. protected-mode no

B. protected-mode yes

C. protected_mode no

D. disable-protected-mode true

Solution

1. Step 1: Identify the correct syntax for the setting

   The Redis config uses protected-mode with a dash, not underscore or other variations.

2. Step 2: Determine the value to disable it

   Setting protected-mode no disables protected mode.

3. Final Answer:

   protected-mode no -> Option A

4. Quick Check:

   Disable protected mode = protected-mode no [OK]

Hint: Use dash and 'no' to disable protected mode [OK]

Common Mistakes:

• Using underscore instead of dash
• Setting value to 'yes' to disable
• Using invalid config keys

3. Given the Redis config snippet:

protected-mode yes
bind 127.0.0.1

What will happen if a client tries to connect from a remote IP?

medium

A. Connection will be rejected due to protected mode and bind settings

B. Connection will be accepted without restrictions

C. Redis will crash with an error

D. Connection will be accepted only if password is provided

Solution

1. Step 1: Analyze protected mode and bind settings

   Protected mode is enabled and Redis is bound only to localhost (127.0.0.1).

2. Step 2: Understand remote connection behavior

   Clients from remote IPs cannot connect because Redis listens only on localhost and protected mode blocks unsafe access.

3. Final Answer:

   Connection will be rejected due to protected mode and bind settings -> Option A

4. Quick Check:

   Protected mode + bind localhost = reject remote [OK]

Hint: Protected mode + bind localhost blocks remote clients [OK]

Common Mistakes:

• Assuming remote connections are allowed
• Thinking Redis crashes on remote connect
• Believing password alone allows connection

4. You set protected-mode no in your Redis config but remote clients still cannot connect. What is the most likely cause?

medium

A. Redis server is not running

B. Redis requires a password to connect remotely

C. The bind setting restricts connections to localhost

D. Protected mode is still enabled by default

Solution

1. Step 1: Check the effect of disabling protected mode

   Disabling protected mode allows remote connections if no other restrictions exist.

2. Step 2: Identify other config restrictions

   If bind 127.0.0.1 is set, Redis only listens on localhost, blocking remote clients.

3. Final Answer:

   The bind setting restricts connections to localhost -> Option C

4. Quick Check:

   Bind localhost blocks remote even if protected mode off [OK]

Hint: Check bind setting if remote access fails despite disabling protected mode [OK]

Common Mistakes:

• Assuming protected mode disables instantly without config reload
• Ignoring bind restrictions
• Thinking password is mandatory for remote connect

5. You want to allow remote connections to Redis safely. Which configuration is the best practice?

hard

A. Set protected-mode no and bind 0.0.0.0 without password

B. Keep protected-mode yes, bind to localhost, and use SSH tunnel for remote access

C. Disable protected mode and allow connections from any IP without authentication

D. Disable protected mode, bind to all interfaces, and require a strong password

Solution

1. Step 1: Understand risks of disabling protected mode

   Disabling protected mode requires securing Redis by other means like authentication.

2. Step 2: Combine settings for safe remote access

   Binding to all interfaces (0.0.0.0) allows remote connections, but a strong password is needed to secure access.

3. Final Answer:

   Disable protected mode, bind to all interfaces, and require a strong password -> Option D

4. Quick Check:

   Safe remote access = disable protected mode + bind all + password [OK]

Hint: Disable protected mode only with password and open bind [OK]

Common Mistakes:

• Disabling protected mode without password
• Binding only to localhost for remote access
• Allowing open access without authentication