Network ports · 6379
6379 — Redis
Port 6379 is the default Redis listener, and an unauthenticated Redis is a common breach.
Key facts
| Port | 6379 |
|---|---|
| Transport | TCP |
| Service | Redis |
| Default auth | None historically |
| Protection | Protected mode and ACLs |
| Exposure | Never public |
An unauthenticated data store
Redis was designed for trusted networks and for years had no authentication by default. An exposed instance lets an attacker read and write every key, and features such as configuration rewriting have been used to write files and execute commands on the host.
Protected mode blocks non-loopback connections when no password is set, but it is a safety net, not a configuration strategy. Public Redis instances are scanned and compromised routinely.
Locking it down
Bind Redis to loopback or a private interface, set a strong password or ACL user, and require TLS if the network is not fully trusted. Disable or rename dangerous commands for application users. Keep the instance behind the same private boundary as the application that uses it.
If a cache must be shared across networks, put it behind a VPN or a proxy that authenticates clients. Port obscurity is not protection.
Frequently asked questions
Is Redis secure by default?
Modern versions enable protected mode for non-loopback connections, but authentication and network isolation are still required.
Can Redis be exposed safely?
Only behind authentication, TLS and a trusted network boundary. Direct internet exposure is not safe.