Redis Protected Mode

Redis Protected Mode

Redis enables protected mode by default, i.e. protected-mode yes in redis.conf. When this is the case and the default user has no password, Redis can only be accessed locally—remote hosts cannot reach it. Once the default user is given a password, remote hosts are allowed to connect.

# Protected mode is a layer of security protection, in order to avoid that
# Redis instances left open on the internet are accessed and exploited.
#
# When protected mode is on and the default user has no password, the server
# only accepts local connections from the IPv4 address (127.0.0.1), IPv6 address
# (::1) or Unix domain sockets.
#
# By default protected mode is enabled. You should disable it only if
# you are sure you want clients from other hosts to connect to Redis
# even if no authentication is configured.
protected-mode yes

This setting exists primarily for security reasons. From a security standpoint, you should still set a password for the default user, or disable the default user altogether and instead create users via ACL with properly scoped permissions.

In real deployments, if you find that a replica cannot synchronize from its master during master-replica replication, check whether the master’s default user has no password configured. If it does not, you should set a password for the default user, or set protected-mode to no. Disabling protected mode is not a recommended way to solve this problem.