Fix: (error) NOAUTH Authentication required. (and securing Redis with ACLs)

In redis-cli the error looks like this:

127.0.0.1:6379> GET user:42
(error) NOAUTH Authentication required.

Client libraries show the same text inside their own exception, for example NOAUTH Authentication required. The server is up; it simply refuses commands from a connection that has not authenticated. That happens when a password is set with requirepass, or when the default user has a password or is disabled in the ACL configuration.

Fix 1: authenticate in redis-cli

export REDISCLI_AUTH='CHANGE_ME'
redis-cli -h cache1.example.com --user appuser PING

redis-cli -h cache1.example.com --user appuser --askpass   # prompt instead

Inside an open session you can run AUTH appuser CHANGE_ME, or AUTH CHANGE_ME for the default user. Avoid -a password on the command line: redis-cli warns that it may not be safe, because other users can see it in the process list and it lands in your shell history.

If the password is accepted but wrong for that user, you get a different error, WRONGPASS invalid username-password pair or user is disabled., which points to a typo, the wrong username, or a user set to off.

Fix 2: give the application its credentials

• Most clients accept a URI: redis://appuser:[email protected]:6379/0, or rediss:// for TLS. Without a username, use default or leave the user part empty, as in redis://:CHANGE_ME@host:6379.
• Load the password from an environment variable or secret store, not from source code.
• If the error appears only after a network blip, check that your client re-authenticates when it reconnects; connection pools that were configured before the password was set will fail this way.

Do not “fix” NOAUTH by removing the password. Authentication is a safety net for when the network protection fails.

Secure the server properly

Redis is designed to be used by trusted clients inside a trusted network. Never expose its port directly to the internet: a single FLUSHALL from an attacker deletes everything, and CONFIG can be abused to write files on the host. Work through these layers.

Network: bind, firewall, protected mode

# redis.conf
bind 127.0.0.1 -::1 10.0.0.21     # loopback plus one private interface
protected-mode yes
port 6379

• bind lists the interfaces Redis listens on. The shipped redis.conf binds to loopback only.
• A host firewall should allow 6379 only from the application servers.
• Protected mode (since 3.2, on by default) makes Redis answer only loopback clients when the default user has no password. Remote clients then get a -DENIED Redis is running in protected mode error that lists ways to turn it off. Do not turn it off; set up authentication instead.

ACL users (Redis 6 and later)

ACLs replace the single shared requirepass password with named users, each limited to certain commands and key patterns. On a fresh server the only user is default, with no password and full access:

127.0.0.1:6379> ACL LIST
1) "user default on nopass ~* &* +@all"

Create an administrator first, test it, then restrict the rest. Generate strong secrets with ACL GENPASS.

ACL SETUSER admin on >CHANGE_ME_ADMIN ~* &* +@all
ACL SETUSER appuser on >CHANGE_ME_APP ~app:* &app:* +@all -@dangerous
ACL SETUSER reporter on >CHANGE_ME_RO ~app:* +@read +ping
ACL SETUSER monitor on >CHANGE_ME_MON +info +ping
AUTH admin CHANGE_ME_ADMIN
ACL WHOAMI

Each rule is applied left to right. on enables the user, >secret adds a password, ~app:* allows keys matching the pattern, &app:* allows Pub/Sub channels, and +@all -@dangerous allows every command except risky ones such as FLUSHALL, KEYS, CONFIG and DEBUG. Key patterns do not limit whole-database commands, so -@dangerous (or explicit -flushall -flushdb -swapdb) is what keeps appuser from wiping other keys.

Now close the anonymous door. Run this only from a session authenticated as admin, after you have confirmed that every application has its own credentials; otherwise those applications start failing with NOAUTH:

ACL SETUSER default off

Persist the ACLs

Changes made with ACL SETUSER live only in memory. Either keep users in redis.conf and run CONFIG REWRITE, or, for more than a few users, use an external ACL file. The two methods cannot be mixed.

# redis.conf
aclfile /etc/redis/users.acl

redis-cli --user admin --askpass ACL SAVE    # write current users to the file
redis-cli --user admin --askpass ACL LOAD    # reload after editing it by hand

Passwords are stored as SHA-256 hashes, so ACL LIST does not reveal them. CONFIG REWRITE does not run ACL SAVE for you.

Also

• Enable TLS when traffic leaves a trusted network: plain AUTH is sent unencrypted. Redis supports TLS for clients, replication and the cluster bus.
• Replicas and Sentinels need their own users with the commands documented for them (+psync +replconf +ping for a replica user on the primary).
• Run Redis as an unprivileged redis system user, never as root.
• rename-command is deprecated; block commands with ACL rules instead.

Official documentation

• Redis docs: Security
• Redis docs: ACL
• Redis docs: AUTH command