Network security (bind, protected-mode) in Redis - Step-by-Step Execution

Concept Flow - Network security (bind, protected-mode)

Start Redis Server

↓

Check 'bind' setting

↓

Listen only on

↓

specified IPs

↓

Check 'protected-mode'

↓

Restrict access

↓

if no password

↓

Accept or Reject connections

↓

End

Redis starts, checks 'bind' to decide which IPs to listen on, then checks 'protected-mode' to restrict or allow access.

Execution Sample

Redis

bind *
protected-mode yes

Redis listens on all interfaces and restricts external access without password.

Execution Table

Step	Setting Checked	Value	Effect	Result
1	bind	*	Listen on all interfaces	Server listens on all interfaces
2	protected-mode	yes	Restrict external access if no password	External connections rejected without password
3	Client connects from 127.0.0.1	N/A	Allowed	Connection accepted
4	Client connects from external IP	N/A	Blocked	Connection rejected
5	Change protected-mode to no	no	Allow external access	External connections accepted if firewall allows
6	Client connects from external IP	N/A	Allowed	Connection accepted
7	End	N/A	N/A	Server running with configured security

💡 Execution ends after server applies bind and protected-mode settings and handles connections accordingly.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 5	Final
bind	not set	*	*	*	*
protected-mode	not set	not set	yes	no	no
allowed_ips	all	all interfaces	all interfaces	all interfaces	all interfaces
connection_status_external	unknown	unknown	rejected	allowed	allowed

Key Moments - 3 Insights

Why does Redis reject external connections even if the firewall allows them?

Because 'protected-mode' is enabled (see step 2 in execution_table), Redis blocks external connections without a password for security.

What happens if 'bind' is not set?

Redis listens on all network interfaces, which can expose it to external connections unless 'protected-mode' restricts access (see concept_flow).

How does changing 'protected-mode' from yes to no affect external connections?

Changing 'protected-mode' to no allows external connections if the firewall permits it (see steps 5 and 6 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what is the effect of setting 'bind' to '*' at step 1?

A Server listens only on localhost

B Server listens on all interfaces

C Server blocks all connections

D Server disables protected-mode

💡 Hint

Check the 'Effect' column in step 1 of execution_table.

At which step does Redis start allowing external connections?

A Step 2

B Step 4

C Step 5

D Step 7

💡 Hint

Look for when 'protected-mode' is changed to 'no' in execution_table.

According to variable_tracker, what is the status of 'connection_status_external' after step 2?

A rejected

B unknown

C allowed

D not set

💡 Hint

Check the 'connection_status_external' row after step 2 in variable_tracker.

Concept Snapshot

Redis network security uses 'bind' to limit listening IPs.
'protected-mode' restricts external access if no password is set.
Setting 'bind *' listens on all interfaces.
'enabled' protected-mode blocks unsafe external connections.
Disabling protected-mode allows external access if firewall permits.

Full Transcript

When Redis starts, it first checks the 'bind' setting to decide which IP addresses it listens on. If 'bind' is set to '*', Redis listens on all network interfaces. If 'bind' is not set, Redis listens on all network interfaces, which can expose it to external connections. Next, Redis checks if 'protected-mode' is enabled. If it is enabled and no password is set, Redis restricts external connections for security. This means external clients cannot connect unless they come from allowed IPs or authentication is configured. If 'protected-mode' is disabled, Redis allows external connections if the network firewall permits. This setup helps protect Redis from unauthorized access. The execution table shows these steps and how connections are accepted or rejected based on these settings. The variable tracker shows how settings and connection status change step by step. Understanding these settings helps keep Redis secure on a network.

Practice

1. What is the main purpose of the bind configuration in Redis?

easy

A. To configure the Redis password

B. To enable data encryption for Redis connections

C. To set the maximum number of client connections

D. To specify which IP addresses can connect to the Redis server

Solution

1. Step 1: Understand the role of bind in Redis

   The bind setting restricts Redis to listen only on specified IP addresses.

2. Step 2: Compare other options

   Encryption, max clients, and password settings are handled by other configurations, not bind.

3. Final Answer:

   To specify which IP addresses can connect to the Redis server -> Option D

4. Quick Check:

   bind controls allowed IPs [OK]

Hint: Remember: bind = allowed IP addresses [OK]

Common Mistakes:

• Confusing bind with password setting
• Thinking bind enables encryption
• Assuming bind sets max clients

2. Which of the following is the correct way to disable protected mode in the Redis configuration file?

easy

A. protected-mode no

B. protected_mode no

C. protected-mode yes

D. disable-protected-mode true

Solution

1. Step 1: Identify correct syntax for protected mode setting

   The correct syntax uses a hyphen and accepts 'yes' or 'no' values: protected-mode no disables it.

2. Step 2: Eliminate incorrect options

   Options with underscores or 'disable-' prefix are invalid in Redis config.

3. Final Answer:

   protected-mode no -> Option A

4. Quick Check:

   Disable protected mode with protected-mode no [OK]

Hint: Use hyphen and 'no' to disable protected mode [OK]

Common Mistakes:

• Using underscore instead of hyphen
• Writing 'disable-protected-mode' which is invalid
• Setting 'protected-mode yes' to disable

3. Given this Redis config snippet:

bind 127.0.0.1
protected-mode yes

Which clients can connect to the Redis server?

medium

A. Only clients connecting from localhost (127.0.0.1)

B. Any client on the network can connect

C. No clients can connect because protected mode is enabled

D. Only clients with a password can connect

Solution

1. Step 1: Analyze the bind setting

   Binding to 127.0.0.1 means Redis listens only on localhost, so only local clients can connect.

2. Step 2: Understand protected-mode effect

   Protected mode 'yes' prevents external access if no password or bind is not localhost, but here bind restricts to localhost anyway.

3. Final Answer:

   Only clients connecting from localhost (127.0.0.1) -> Option A

4. Quick Check:

   bind localhost + protected-mode yes = local clients only [OK]

Hint: bind localhost + protected-mode yes = local access only [OK]

Common Mistakes:

• Thinking protected mode blocks all connections
• Assuming any network client can connect
• Confusing password requirement with protected mode

4. You set bind 0.0.0.0 and protected-mode no in your Redis config. What is the main security issue with this setup?

medium

A. Redis will only accept connections from localhost

B. Redis will reject all connections due to conflicting settings

C. Redis will be open to all network clients without protection

D. Redis will require a password for all connections

Solution

1. Step 1: Understand bind 0.0.0.0 meaning

   Binding to 0.0.0.0 means Redis listens on all network interfaces, allowing any IP to connect.

2. Step 2: Effect of disabling protected mode

   Protected mode off disables safety checks, so no restrictions or warnings prevent unauthorized access.

3. Final Answer:

   Redis will be open to all network clients without protection -> Option C

4. Quick Check:

   bind all + protected-mode no = open and unsafe [OK]

Hint: bind all + protected-mode no = open to everyone [OK]

Common Mistakes:

• Thinking Redis blocks connections with these settings
• Assuming password is required automatically
• Believing protected mode disables binding

5. You want your Redis server to accept connections only from two IP addresses: 192.168.1.10 and 10.0.0.5, and ensure it is protected from unauthorized access. Which configuration is correct?

hard

A. bind 0.0.0.0\nprotected-mode no

B. bind 192.168.1.10 10.0.0.5\nprotected-mode yes

C. bind 192.168.1.10\nprotected-mode no

D. bind 10.0.0.5\nprotected-mode yes

Solution

1. Step 1: Set bind to specific IP addresses

   Using bind 192.168.1.10 10.0.0.5 restricts Redis to listen only on these two IPs.

2. Step 2: Enable protected mode for safety

   Setting protected-mode yes adds an extra layer of protection against unauthorized access.

3. Final Answer:

   bind 192.168.1.10 10.0.0.5\nprotected-mode yes -> Option B

4. Quick Check:

   Bind specific IPs + protected mode yes = secure setup [OK]

Hint: Bind only allowed IPs and keep protected mode on [OK]

Common Mistakes:

• Binding to all IPs with protected mode off
• Binding only one IP when two are needed
• Disabling protected mode when security is required