redis-security — Claude Code skill: Redis security
Guides Redis hardening with authentication, TLS, ACLs and network restrictions. Use it when deploying or auditing a production Redis instance.
npx skills add redis/agent-skills --skill redis-security -a claude-codeWhat redis-security does
This skill gives an agent a Redis security checklist covering passwords or ACL users, TLS connections, interface binding, protected-mode and firewall rules. It also covers disabling FLUSHALL, DEBUG and CONFIG.
It recommends dedicated ACL accounts for each application, with only the key patterns and commands that account needs. The included examples cover a cache reader, a writer without dangerous operations, and an administrator. A shared requirepass is treated as a shortcut for the default user.
The skill includes redis.conf settings, ACL SETUSER commands, a Python redis.Redis connection and iptables rules. Using bind 0.0.0.0 with protected-mode no exposes Redis across the network, so check for that combination first.
What it helps with
- configure Redis passwords and TLS
- create least-privilege ACL users
- restrict Redis access with
bindand firewall rules - disable destructive Redis commands
- audit Redis for public network exposure
Example prompts for the agent
- Review my
redis.conffor production Redis security. - Create an ACL user that can read
cache:*but cannot run dangerous commands. - Configure a TLS Redis connection in Python with
redis.Redis.
How to install redis-security
1Skills CLI (Vercel)
npx skills add redis/agent-skills --skill redis-security -a claude-code2Manually: put the files in place
~/.claude/skills/redis-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/redis-security/
1Skills CLI (Vercel)
npx skills add redis/agent-skills --skill redis-security -a codex2Manually: put the files in place
.agents/skills/redis-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add redis/agent-skills --skill redis-security -a cursor2Manually: put the files in place
.cursor/skills/redis-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install redis/agent-skills redis-security2Manually: put the files in place
.github/skills/redis-security/SKILL.md1Skills CLI (Vercel)
npx skills add redis/agent-skills --skill redis-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/redis/agent-skills --path skills/redis-securityManually: put the files in place
.devin/skills/redis-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add redis/agent-skills --skill redis-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about redis-security
How do I install redis-security in Claude Code?
Run npx skills add redis/agent-skills --skill redis-security -a claude-code, then run npx skills add redis/agent-skills --skill redis-security -a claude-code again. The skill file is at ~/.claude/skills/redis-security/SKILL.md.
What does redis-security do?
It guides Redis authentication, TLS, ACL permissions and network access restrictions. It includes examples for redis.conf, ACL commands, iptables and Python connections.
Why use ACL users instead of requirepass?
ACL users let each application receive only the commands and key patterns it needs. requirepass uses a shared password for the default user.
Source text
SKILL.md · MIT
---
name: redis-security
description: Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.
license: MIT
metadata:
author: Redis, Inc.
version: "0.1.0"
---
# Redis Security
Production hardening for Redis: authentication, ACL-based access control, and network exposure. Cover all three together — any one of them on its own leaves an exploitable gap.
## When to apply
- Deploying or reviewing a Redis instance destined for production.
- Setting up application credentials beyond a shared password.
- Auditing a Redis deployment against a security checklist.
- Receiving "Redis exposed to the internet" findings from a scanner.
## 1. Always authenticate (and use TLS)
Never run a production Redis without a password. Pair authentication with TLS so credentials and data aren't sent in clear text.
```
# redis.conf
requirepass your-strong-password
tls-port 6380
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
```
```python
r = redis.Redis(
host="localhost",
port=6380,
password="your-strong-password",
ssl=True,
ssl_cert_reqs="required",
)
```
If you can use ACL users (next section) instead of the single `requirepass`, do — `requirepass` is effectively the legacy "default user" shortcut.
See [references/auth.md](references/auth.md).
## 2. ACLs for least-privilege access
The `default` user with a shared password is fine for development. For production, give each application a dedicated ACL user with only the commands and key patterns it actually needs.
```
# Cache-only reader
ACL SETUSER app_readonly on >password ~cache:* +get +mget +scan
# Writer that can't run dangerous ops
ACL SETUSER app_writer on >password ~* +@all -@dangerous
# Admin (use sparingly, never for application traffic)
ACL SETUSER admin on >strong-password ~* +@all
```
Useful command categories:
| Category | What it covers |
|---|---|
| `@read` | Read commands (`GET`, `MGET`, `HGET`, ...) |
| `@write` | Write commands (`SET`, `DEL`, `XADD`, ...) |
| `@dangerous` | `FLUSHALL`, `DEBUG`, `KEYS`, etc. |
| `@admin` | Administrative commands |
If app credentials leak, a tight ACL bounds the blast radius — the attacker can't `FLUSHALL` your DB just because they grabbed a cache reader's password.
See [references/acls.md](references/acls.md).
## 3. Restrict network access
The most common Redis breach is a public-internet Redis with no auth. Avoid that with three layers:
```
# redis.conf — bind to specific interfaces, keep protected-mode on
bind 127.0.0.1 192.168.1.100
protected-mode yes
```
```bash
# Firewall — allow only application subnets
iptables -A INPUT -p tcp --dport 6379 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP
```
Anti-pattern: `bind 0.0.0.0` + `protected-mode no` — exposes Redis to the whole network without protection.
Optional but recommended: rename or disable destructive commands so a compromised client can't trash the DB:
```
rename-command FLUSHALL ""
rename-command DEBUG ""
rename-command CONFIG ""
```
See [references/network.md](references/network.md).
## References
- [Redis: Security](https://redis.io/docs/latest/operate/oss_and_stack/management/security/)
- [Redis: ACL](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/)
© Redis, Inc. · MIT · redis/agent-skills
