Redis is an in-memory data store used as a cache, session store, queue backend and rate limiter. It’s extremely fast because it keeps data in RAM, and it’s simple to install. The important part is configuring it safely: an exposed, password-less Redis is one of the most commonly exploited services on the internet.

1. Install Redis

Ubuntu’s repository version is fine for most uses:

sudo apt update
sudo apt install -y redis-server

For the newest release, Redis publishes its own apt repository at packages.redis.io; the configuration steps below are the same.

Check that it runs:

systemctl status redis-server --no-pager
redis-cli ping      # → PONG

2. Let systemd supervise Redis

In /etc/redis/redis.conf, find the supervised directive and set it to systemd (recent Ubuntu packages already default to this or auto):

supervised systemd

This lets systemd track the process properly for restarts and status.

3. Keep Redis on localhost

By default the Ubuntu package binds to 127.0.0.1 ::1 and runs in protected mode. Verify:

bind 127.0.0.1 -::1
protected-mode yes
port 6379

If your app runs on the same server, leave it like this. Never bind to 0.0.0.0 without a firewall rule restricting port 6379 to specific IPs. Attackers scan the whole internet for open Redis and abuse it to write SSH keys or cron jobs onto the server.

If another server needs access, prefer a private network or a VPN such as WireGuard, and allow only that peer:

sudo ufw allow from 10.8.0.2 to any port 6379 proto tcp

4. Require a password

Even on localhost, a password stops other local processes and users from reading your data. Generate one:

openssl rand -base64 32

In redis.conf:

requirepass YOUR_LONG_RANDOM_PASSWORD

Redis 6+ also supports ACL users with per-command permissions, which is better when several apps share one Redis:

user default off
user app on >APP_PASSWORD ~app:* +@all -@dangerous
user admin on >ADMIN_PASSWORD ~* +@all

This disables the password-less default user, restricts app to keys starting with app: and blocks dangerous commands like FLUSHALL and CONFIG.

5. Set a memory limit and eviction policy

Without a limit, Redis grows until the server runs out of RAM and the kernel’s OOM killer steps in. For a cache:

maxmemory 256mb
maxmemory-policy allkeys-lru

allkeys-lru evicts the least recently used keys when full — right for a pure cache. If Redis stores data you can’t lose (queues, sessions), use noeviction and size the memory appropriately; writes then fail with an error instead of silently dropping data. More in Redis maxmemory and eviction.

6. Persistence

Ubuntu’s default config saves RDB snapshots to /var/lib/redis/dump.rdb periodically. Options:

  • Cache only — disable persistence entirely for speed: save "" and appendonly no.
  • Data you care about — enable the append-only file: appendonly yes with appendfsync everysec (lose at most one second of writes).

Details in Redis persistence: RDB vs AOF.

7. Restart and test

sudo systemctl restart redis-server
redis-cli
127.0.0.1:6379> PING
(error) NOAUTH Authentication required.
127.0.0.1:6379> AUTH YOUR_LONG_RANDOM_PASSWORD
OK
127.0.0.1:6379> SET greeting "hello"
OK
127.0.0.1:6379> GET greeting
"hello"

With ACL users: AUTH app APP_PASSWORD. You can also pass credentials on the command line (redis-cli --user app --pass …), though they then appear in the shell history.

8. Kernel settings

Redis logs warnings at startup if the kernel isn’t tuned for it. Two common ones:

# Allow background saves to fork reliably on low-memory servers
echo 'vm.overcommit_memory = 1' | sudo tee /etc/sysctl.d/90-redis.conf
sudo sysctl --system

Transparent Huge Pages can cause latency spikes; Redis recommends disabling THP if it warns about it (echo never > /sys/kernel/mm/transparent_hugepage/enabled, made persistent via a systemd unit or kernel parameter).

Connect from your application

Connection URLs look like:

redis://:[email protected]:6379/0
redis://app:[email protected]:6379/0

The trailing number selects the logical database (0–15). For WordPress, see WordPress Redis object cache.

Monitoring basics

redis-cli -a PASSWORD INFO memory | grep used_memory_human
redis-cli -a PASSWORD INFO stats | grep -E 'keyspace_hits|keyspace_misses|evicted_keys'
redis-cli -a PASSWORD --latency

A low hit ratio means the cache isn’t helping much; a rising evicted_keys count means maxmemory is too small.

Redis, Valkey and licensing

Redis changed its license in 2024, and the Linux Foundation’s Valkey fork appeared as a drop-in, BSD-licensed alternative. Later Redis versions added an AGPL option. For most self-hosted use the practical differences are small; some distributions now package Valkey. See Valkey vs Redis.

Redis is light: a cache for a busy site often needs only a few hundred megabytes. Any VPS plan with 2 GB of RAM or more runs Redis next to your web stack comfortably.

  • Redis
  • Ubuntu
  • Caching