Redis Master-Replica Replication — masteruser

By default, the user for the connection between master and replica is the default user, but in many production environments the default user is disabled. Following the principle of least privilege, it is recommended to create a dedicated user for replication authentication. In Redis you can configure which user the replica uses to connect to the master, via the masteruser setting.

Replication Configuration

In Redis master-replica replication you can specify the connection user — i.e. which user the replica uses to connect to the master. The default is the default user, but you can specify another. How?

Both master and replica must configure ACLs, setting the user’s password and permissions. For example, create a user replica dedicated to replication and grant it the commands required for replication:

postgres@slpc:/etc/redis$ sudo cat users.acl
user replica on #0ac34389d10624a1f24a923b63b0d8a739350686f8149ef4149f6c4a3703a42e ~* &* -@all +replconf +psync +ping

Add the following to redis.conf:

masteruser replica   # the user the replica uses to connect to the master
masterauth <PASSWORD>

Replication Log Analysis

Replica log:

130232:S 21 Jan 2026 14:26:04.515 * Before turning into a replica, using my own master parameters to synthesize a cached master: I may be able to synchronize with the new master with just a partial transfer.
130232:S 21 Jan 2026 14:26:04.515 * Ready to accept connections
130232:S 21 Jan 2026 14:26:04.516 - DB 0: 2 keys (0 volatile) in 4 slots HT.
130232:S 21 Jan 2026 14:26:04.516 * Connecting to MASTER 192.168.232.128:6379    # connect to master
130232:S 21 Jan 2026 14:26:04.516 * MASTER <-> REPLICA sync started
130232:S 21 Jan 2026 14:26:04.517 * Non blocking connect for SYNC fired the event.
130232:S 21 Jan 2026 14:26:04.518 * Master replied to PING, replication can continue...
130232:S 21 Jan 2026 14:26:04.519 * Trying a partial resynchronization (request 41d1777223513929c644c859b467a1eed109a8e0:13885).
130232:S 21 Jan 2026 14:26:04.520 * Successful partial resynchronization with master.
130232:S 21 Jan 2026 14:26:04.520 # Master replication ID changed to adbfa6dda0b49450836902276f0cf2040e554271
130232:S 21 Jan 2026 14:26:04.520 * MASTER <-> REPLICA sync: Master accepted a Partial Resynchronization.

Master log:

166002:M 21 Jan 2026 14:26:03.553 * Ready to accept connections
166002:M 21 Jan 2026 14:26:03.553 - DB 0: 2 keys (0 volatile) in 4 slots HT.
166002:M 21 Jan 2026 14:26:04.495 - Accepted 192.168.232.137:40060
166002:M 21 Jan 2026 14:26:04.498 * Replica 192.168.232.137:6379 asks for synchronization
166002:M 21 Jan 2026 14:26:04.498 * Partial resynchronization request from 192.168.232.137:6379 accepted. Sending 0 bytes of backlog starting from offset 13885.
166002:M 21 Jan 2026 14:26:04.509 - Accepted 192.168.232.138:56888
166002:M 21 Jan 2026 14:26:04.512 * Replica 192.168.232.138:6379 asks for synchronization
166002:M 21 Jan 2026 14:26:04.513 * Partial resynchronization request from 192.168.232.138:6379 accepted. Sending 0 bytes of backlog starting from offset 13885.

Source Code Analysis

When the replicaof command is executed, replicaofCommand is called:

replicaofCommand(client *c)
--> replicationSetMaster(c->argv[1]->ptr, port);
    --> connectWithMaster();    // connect to master
        // initiate the connection with the master's ip and port
        --> connConnect(server.repl_transfer_s, server.masterhost, server.masterport, server.bind_source_addr, syncWithMaster)

Once the connection succeeds, syncWithMaster is called:

void syncWithMaster(connection *conn) {

    /* If this event fired after the user turned the instance into a master
     * with SLAVEOF NO ONE we must just return ASAP. */
    if (server.repl_state == REPL_STATE_NONE) {
        connClose(conn);
        return;
    }

    // Send the AUTH command.
    // The replica authenticates to the master: if masteruser is configured,
    // it authenticates as that user, and the password is read from masterauth.
    if (server.repl_state == REPL_STATE_SEND_HANDSHAKE) {
        /* AUTH with the master if required. */
        if (server.masterauth) {
            char *args[3] = {"AUTH",NULL,NULL};
            size_t lens[3] = {4,0,0};
            int argc = 1;
            if (server.masteruser) {  // add the auth user
                args[argc] = server.masteruser;
                lens[argc] = strlen(server.masteruser);
                argc++;
            }
            args[argc] = server.masterauth; // add the auth password
            lens[argc] = sdslen(server.masterauth);
            argc++;
            err = sendCommandArgv(conn, argc, args, lens); // send auth info to master
            if (err) goto write_error;
        }

        // Send the REPLCONF command.
        // 1. Tell the master the replica's listening port.
        sendCommand(conn,"REPLCONF",
                    "listening-port",portstr, NULL);
        // 2. Tell the master the replica's capabilities.
        sendCommand(conn,"REPLCONF",
                "capa","eof","capa","psync2",NULL);

    }

    // Attempt a partial resynchronization by sending PSYNC to the master.
    slaveTryPartialResynchronization(conn,1);
}