How to install Redis on Ubuntu and Debian, and secure it

Short answer: run sudo apt install redis-server on Ubuntu or Debian. The package starts Redis under systemd, listening on 127.0.0.1 and ::1, port 6379, and redis-cli ping answers PONG. For Redis 8 on an older release, add the official packages.redis.io repository first. Then set a password, pick RDB or AOF persistence and cap memory with maxmemory.

sudo apt update
sudo apt install -y redis-server
redis-cli ping
PONG

The package versions on this page come from the Debian 12 package index on our own server and from packages.debian.org and Launchpad, read on 21 October 2026. The configuration follows the redis.conf that Redis ships, Debian’s packaging and the Redis documentation; Redis itself was not run for this guide, so the outputs are labelled as examples.

Which Redis version will you get?

Distribution packages are fixed to one Redis version for the life of the release and get security fixes through apt upgrade. Debian 12’s 7.0.15, for example, carries patches for CVEs published in 2025 and 2026. That is the right default for a cache or a job queue. Use the Redis repository when an application needs a Redis 8 feature, or when all your servers should run the same version.

How do I install Redis on Ubuntu or Debian?

sudo apt update
sudo apt install -y redis-server
systemctl status redis-server --no-pager
redis-cli INFO server | grep redis_version

The package creates a redis system user, starts the service and enables it at boot. Where things live on Debian and Ubuntu:

• /etc/redis/redis.conf: the configuration, commented line by line.
• /var/lib/redis: the data directory (dump.rdb, and the AOF directory once you turn AOF on).
• /var/log/redis/redis-server.log: the log. Startup failures before Redis opens its log show up in journalctl -u redis-server.

Many older tutorials tell you to change supervised no to supervised systemd. With the Debian and Ubuntu package there is nothing to change: the unit starts redis-server /etc/redis/redis.conf --supervised systemd --daemonize no as Type=notify, and command-line options win over the file. The same unit runs Redis with ProtectSystem=strict, so Redis may only write to /var/lib/redis, /var/log/redis, its runtime directory and /etc/redis. Move dir somewhere else and saving fails with Read-only file system until you add that path with sudo systemctl edit redis-server and a ReadWritePaths= line. The usual start, stop, restart and enable commands are in systemctl commands.

How do I install Redis 8 from packages.redis.io?

Redis publishes its own APT repository. These are the commands from the Redis documentation, unchanged:

sudo apt-get install lsb-release curl gpg
curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
sudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list
sudo apt-get update
sudo apt-get install redis

The redis package pulls in redis-server and redis-tools, so the service is still called redis-server and the paths above stay the same. The repository’s packages carry a higher epoch (6:) than Debian’s and Ubuntu’s (5:), so they replace the distribution packages on the next upgrade. apt policy redis lists every version on offer; to stay on one line, pin it in /etc/apt/preferences.d/redis:

Package: redis redis-server redis-sentinel redis-tools
Pin: version 6:8.*
Pin-Priority: 1001

If apt-get update reports a 404 for that line, the repository has no build for your release codename; stay on the distribution package. Redis should start on its own after the install. If it does not, run sudo systemctl enable --now redis-server.

Redis in Docker

docker run -d --name redis --restart unless-stopped \
  -p 127.0.0.1:6379:6379 \
  -v redis-data:/data \
  redis:8 redis-server --appendonly yes --requirepass 'a-long-random-password'

The official image turns protected mode off so that other containers can reach it, and its documentation warns that a published port is then open without a password. Docker also writes its own iptables rules, so a port published as -p 6379:6379 is reachable from the internet whatever ufw says. Keep the 127.0.0.1: prefix, or leave the port unpublished and connect over a Docker network. Setting Docker up is covered in installing Docker on Ubuntu and Debian.

How do I secure Redis?

Redis was designed for trusted networks. Four settings decide who can talk to it:

bind 127.0.0.1 -::1
protected-mode yes
port 6379
# requirepass foobared

• bind: the addresses Redis listens on. The default is localhost over IPv4 and IPv6. The - in front of ::1 marks an address as optional, so Redis still starts on a machine where IPv6 is switched off. Redis 6.0 on Ubuntu 22.04 writes the line without the -.
• protected-mode: while it is on and the default user has no password, Redis answers clients from other addresses only with a DENIED error. It is a safety net for a wrong bind, not a firewall.
• requirepass: the password of the default user. Since Redis 6 it is a shortcut into the ACL system.
• ACL users: named users with their own password, key patterns and allowed commands. Give each application one.

1. 1Generate two long passwords

   openssl rand -hex 32    # admin, for the default user
   openssl rand -hex 32    # the application

2. 2Set them in redis.conf

   requirepass ADMIN-PASSWORD-FROM-STEP-1
   user app on >APP-PASSWORD-FROM-STEP-1 ~app:* &app:* +@all -@dangerous

   ~app:* limits the user to keys that start with app:, &app:* to matching Pub/Sub channels, and +@all -@dangerous allows every command except the dangerous category, which holds FLUSHALL, CONFIG, KEYS and DEBUG among others. Without requirepass the default user stays open as nopass, and anyone who reaches the port can skip your ACL user. The file holds secrets, so keep it at mode 640, owner redis. Redis 6.0, the version in Ubuntu 22.04, predates channel rules and --askpass (both came with 6.2): drop the &app:* part there.

3. 3Restart and test

   $ sudo systemctl restart redis-server
   $ redis-cli ping
   (error) NOAUTH Authentication required.
   $ REDISCLI_AUTH='ADMIN-PASSWORD' redis-cli ping
   PONG
   $ redis-cli --user app --askpass
   Please input password: ****
   127.0.0.1:6379> SET app:hello world
   OK
   127.0.0.1:6379> FLUSHALL
   (error) NOPERM User app has no permissions to run the 'flushall' command

   redis-cli -a PASSWORD works too, but it prints a warning because the password ends up in your shell history and the process list. Applications use a URL such as redis://app:APP-PASSWORD@127.0.0.1:6379/0.

The Unix socket: no TCP port at all

When the application runs on the same server, a Unix socket is faster than TCP and cannot be reached from the network. Debian’s file already names the path:

port 0
unixsocket /run/redis/redis-server.sock
unixsocketperm 770

port 0 switches TCP off. Add the application’s user to the redis group (sudo usermod -aG redis www-data, see adding a user to a group), restart both services and connect with redis-cli -s /run/redis/redis-server.sock.

Never expose port 6379

Check what Redis actually listens on:

$ sudo ss -tlnp | grep 6379
LISTEN 0  511  127.0.0.1:6379  0.0.0.0:*  users:(("redis-server",pid=712,fd=6))
LISTEN 0  511      [::1]:6379     [::]:*  users:(("redis-server",pid=712,fd=7))

Only 127.0.0.1 and [::1] is what you want. If an application server elsewhere must connect, prefer a private network, a WireGuard tunnel or an SSH tunnel. If you must bind a public address, add it to bind, keep the passwords from above, and open the port for that one address only, as in the ufw firewall guide:

sudo ufw allow from 198.51.100.7 to any port 6379 proto tcp
sudo ufw status numbered

Redis also speaks TLS (tls-port, tls-cert-file, tls-key-file) when traffic has to cross a network you do not control.

Persistence: RDB, AOF or both?

The default save rule takes a snapshot after an hour if one key changed, after five minutes if 100 changed, or after a minute if 10,000 changed. The Redis documentation recommends both methods together if you want data safety comparable to PostgreSQL; after a restart Redis then loads the AOF, because it is the more complete of the two. For a pure cache, switch both off with save "" and appendonly no.

To turn AOF on for a server that already holds data, back up dump.rdb and follow the documented order. Just editing the file and restarting can lose data. With a password set, run these as the default user, for example with REDISCLI_AUTH exported:

redis-cli CONFIG SET appendonly yes
redis-cli INFO persistence | grep -E 'aof_rewrite_in_progress|aof_rewrite_scheduled|aof_last_bgrewrite_status'
redis-cli CONFIG REWRITE      # writes the change into /etc/redis/redis.conf

Wait until both counters read 0 and the status reads ok before the next restart. For backups, copying dump.rdb while Redis runs is safe: Redis writes each snapshot under a temporary name and renames it into place only when it is complete. Copy it off the server too.

maxmemory and eviction

On a 64-bit system Redis has no memory limit by default. It grows until the kernel runs out of memory and kills it, or something next to it. Set a limit and decide what happens when Redis reaches it:

maxmemory 1gb
maxmemory-policy allkeys-lru

Leave headroom. While Redis saves an RDB file or rewrites the AOF it forks, and under a heavy write load the documentation says memory use can reach twice the normal amount. On a server that also runs the application, a maxmemory of a quarter to a half of the RAM is a sane start. redis-cli INFO memory shows used_memory_human next to the limit. If Redis has already been killed, read why Linux kills processes when memory runs out.

Redis licence changes, and Valkey

• Up to Redis 7.2: BSD 3-Clause, an open source licence.
• Redis 7.4 (change announced in March 2024): Redis Ltd. moved to a dual licence, the Redis Source Available License v2 (RSALv2) or the Server Side Public License v1 (SSPLv1). Neither is an OSI-approved open source licence.
• Redis 8 (general availability on 1 May 2025): the GNU AGPLv3 was added as a third option, and the free product was renamed from Redis Community Edition to “Redis Open Source”. Redis’s licence page lists Redis 8 and later under that tri-licence.
• Valkey: a fork of Redis 7.2.4 under the BSD licence, announced by the Linux Foundation on 28 March 2024 with backing from several large cloud and software companies. As of October 2026, valkey.io lists 9.1.2 as its newest release. Its binaries are valkey-server and valkey-cli, and it keeps the Redis protocol, so most Redis client libraries connect unchanged.

For running Redis as the cache or queue behind your own application, every one of these licences allows it. The differences matter if you modify Redis or offer it as a service to others; read the licence texts for that case. On Debian 13 or with backports on Debian 12, sudo apt install valkey-server installs Valkey, and the security advice on this page applies to it unchanged.

Common Redis errors

Running Redis on a VPS

Redis keeps the whole dataset in RAM and runs commands on one main thread, so memory is the number to size by, not cores. Add the fork headroom from above and the memory your application needs. Most setups run Redis on the same server as the application, bound to localhost or a Unix socket, which removes the network question entirely. The smallest Standard KVM plan has 2 cores and 4 GB of RAM, enough for a cache of a few hundred megabytes next to a web application, and the larger plans add memory in steps up to 64 GB. Our Linux VPS comes with Ubuntu and Debian images, so the apt commands above apply as written; check which ports should be open once the stack is up.

Frequently asked