The basic security

When Redis was designed, the main goals were maximum performance and simplicity, rather than maximum security. Although Redis implements a basic security mechanism, which is based on plain-text passwords, Redis does not implement Access Control List (ACL). Therefore, it is not possible to have users with different permission levels.

The authentication feature can be enabled through the configuration requirepass. Since Redis is superfast, requirepass could be dangerous as a malicious user could potentially guess thousands of passwords in a second. Avoid this by choosing a complex password of at least 64 characters.

After it is enabled, Redis will reject any commands from unauthenticated clients.

Copy the default redis.conf file to the chapter 7 folder, which is in the Redis source code directory. Every time the Redis configuration file is changed, the redis-server needs to be restarted; otherwise, the changes will not be applied.

Add the following to redis.conf:

requirepass...