Install and Secure Redis on CentOS 7

Step 1 – Install and Enable Remi Repository

Firstly, we will add the Remi repository to the CentOS 7 system. The Remi repository provides the latest version of Redis package for our installation.

Before adding the Remi repository, let’s install the EPEL repository and yum utility packages.

sudo yum install epel-release yum-utils

Now add the Remi repository for CentOS 7 using the yum command below.

sudo yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm

After that, enable the ‘remi’ repository using the yum-config-manager tool as below.

sudo yum-config-manager --enable remi

The Remi repository has been added and enabled on the CentOS 7 system, check using the yum command below.

yum repolist enabled

And you will get the result as below.

Step 2 – Install Redis on CentOS 7

After installing the Remi repository, we will install the latest Redis package. You can check the available Redis version using the yum command below.

yum search redis
yum info redis

Now you will get the Redis 5.0.5 is available on the Remi repository.

Install Redis using the command below.

sudo yum -y install redis

Once the installation is complete, start the redis service and add it to the system boot.

systemctl start redis
systemctl enable redis

The Redis service is up and running with the default configuration, check the service status and the port used by the server.

systemctl status redis
netstat -plntu

And you will get the result as below.

The Redis server is up and running on CentOS 7 system, running the localhost IP address ‘127.0.0.1’ with default TCP port ‘6379’.

Step 3 – Configure Redis

In this step, we’re going to configure our Redis Server installation on the CentOS 7 server.

Edit the Redis configuration file ‘/etc/redis.conf’ using vim editor.

vim /etc/redis.conf

Now change ‘bind’ address with your internal IP address. If you’re running as a cluster, you can change with the private IP address. It’s recommended to run the Redis Server on private internal IP address.

bind 127.0.0.1

Now change the ‘daemonize’ value to ‘yes’, because we will run the Redis service as a daemon.

daemonize yes

Since we’re using the CentOS 7 server and systemd, so we need to change the ‘supervised’ line configuration to ‘systemd’.

supervised systemd

Save and close.

Now restart the redis service.

systemctl restart redis

The basic configuration of the Redis Server has been completed. Now connect to the Redis Server using the redis-cli command as below.

redis-cli

Run the ping command below.

ping
ping "Hello Redis"

If your installation is correct, you will get the ‘PONG’ reply and the message that you write after the command.

Step 4 – Securing Redis Installation

In this step, we’re going to secure our Redis installation. There are 3 things that you must know about securing the Redis Server.

1. Network Security
The Network security for redis server is related with the ‘bind’ configuration on the redis configuration ‘redis.conf’. It’s recommended to use the internal private network for your Redis installation and don’t use the public.

Edit the Redis configuration file ‘/etc/redis.conf’ using vim editor.

vim /etc/redis.conf

On the ‘bind’ section, change the IP address with your own internal network IP address.

bind INTERNAL-IP-ADDRESS

Save and close. And now the redis service will run under the ‘INTERNAL-IP-ADDRESS’.

2. Password Authentication
The password authentication for Redis will give you access control to your Redis server. This is a little layer of security that will enhance your Redis server security, and it is not yet enabled by default installation.

To enable the Password Authentication for Rediser server, you will need to uncomment the ‘requirepass’ section on the ‘redis.conf’ file and type your strong password after it.

requirepass hakase-labs321@#$

Change the ‘hakase-labs321@#$’ with your strong password. And now the password authentication for Redis has been enabled.

3. Disabling Dangerous Redis Command
Redis provides a feature for disabling some specific Redis command. This feature can be used to rename or disable some of the dangerous commands such as ‘FLUSHALL’ for erasing all data, ‘CONFIG’ command to setup configuration parameter through the Redis CLI, etc.

To change or disable the Redis command, you can use the ‘rename-command’ option. Edit the redis configuration file ‘redis.conf’ and add some configurations below.

# rename-command COMMAND "CUSTOM"
rename-command CONFIG "REDISCONFIG"
rename-command FLUSHALL "DELITALL"

Save and close. Once all is complete, restart the redis service using the systemctl command below.

systemctl restart redis

And the basic Redis security for securing Redis installation has been applied to our host.

Other consideration, you may also need the ‘Data Encryption’ support for Redis, as well as the secure coding needed on the application side.

Step 5 – Testing

In this step, we’re going to test our Redis Server deployment using the ‘redis-cli’ command line.

– Testing Host and Authentication
Connect to the Redis Server using the redis-cli command by specifying the redis server hostname/ IP address and port.

redis-cli -h 10.5.5.15 -p 6379

Change the ‘10.5.5.15’ with your IP address. Once you’re connected to the server, try the ping command.

ping
ping "Hello Redis"

If you’re getting ann error because you need to authenticate before invoking any command on the Redis CLI shell.

Run the following command to authenticate against the Redis Server.

AUTH hakase-labs321@#$

Once you’re authenticated, you can try the ping command and you will get a reply from the Redis server.

ping
ping "Hello Redis"

Src: https://www.howtoforge.com/how-to-install-and-secure-redis-on-centos-7/