How to Install and Configure Redis

Redis is an in-memory data structure store used as a cache, message broker, and primary database. Getting it right means more than just running apt install redis: you need to think about persistence, network exposure, and authentication before the first client connects. This guide walks through a production-ready Redis setup on modern Linux using systemd for process management.

Install Redis

Debian / Ubuntu

Ubuntu 22.04 LTS and Debian 12 both ship a current Redis 7.x package from the official repositories. For the absolute latest, use the Redis-provided repository, but the distro package is fine for most workloads.

sudo apt update && sudo apt install -y redis-server

Fedora / RHEL 9 / Rocky Linux 9

On RHEL-family systems Redis lives in the AppStream module. Enable and install it in one step:

sudo dnf install -y redis

On RHEL 9 / Rocky 9, if the package is not found, ensure AppStream is enabled:

sudo dnf module enable redis:7 -y && sudo dnf install -y redis

Arch Linux

sudo pacman -S redis

Start and Enable the Service

Redis ships with a systemd unit on all three distro families. Enable it so it survives reboots, then start it immediately.

sudo systemctl enable --now redis

On Debian/Ubuntu the unit name is redis-server, not redis:

sudo systemctl enable --now redis-server

Verify the service is active:

systemctl status redis        # Fedora/Arch
systemctl status redis-server # Debian/Ubuntu

You should see Active: active (running) in the output. A quick smoke test:

redis-cli ping

Expected response: PONG

Configure Redis

The main configuration file is /etc/redis/redis.conf on Debian/Ubuntu and /etc/redis/redis.conf or /etc/redis.conf on Fedora/RHEL. Make a backup before editing.

sudo cp /etc/redis/redis.conf /etc/redis/redis.conf.bak

Bind Address

By default Redis 7.x binds to 127.0.0.1 and ::1 only — leave it that way unless you have a specific reason to expose it on the network. If you must listen on a LAN interface, change only the directives you need:

sudo sed -i 's/^bind 127.0.0.1.*/bind 127.0.0.1/' /etc/redis/redis.conf

If you do open Redis to a network interface, protect it with a firewall rule (see Security section).

Memory Limit

Set a maximum memory limit and an eviction policy so Redis never silently consumes all available RAM. Edit /etc/redis/redis.conf:

sudo nano /etc/redis/redis.conf

Locate and set (or add) these directives. Example for a 1 GB limit with LRU eviction for a cache workload:

maxmemory 1gb
maxmemory-policy allkeys-lru

For a primary-database workload where you cannot afford silent eviction, use noeviction instead and monitor memory carefully.

Persistence Options

Redis offers three persistence strategies. Pick one based on your durability requirements.

RDB Snapshots (default)

RDB writes a point-in-time snapshot to disk. It is fast to restore but can lose up to the interval's worth of writes on a crash. The default configuration already enables RDB. The relevant lines in redis.conf look like this:

save 3600 1
save 300 100
save 60 10000

This means: save if at least 1 key changed in 3600 s, 100 keys in 300 s, or 10 000 keys in 60 s. Tune or remove the save lines to adjust the trade-off.

Append-Only File (AOF)

AOF logs every write operation. Combined with fsync everysec you risk at most one second of data loss. Enable it in redis.conf:

appendonly yes
appendfsync everysec

AOF files grow over time. Redis rewrites them automatically when the file doubles in size (auto-aof-rewrite-percentage 100), which is the default. Leave it enabled.

No Persistence (pure cache)

If Redis is purely a cache and data loss on restart is acceptable, disable both:

save ""
appendonly no

This gives the best write throughput and the simplest operational model.

Security

Require a Password

Redis has no user authentication enabled by default in many package installs. Set a strong password with the requirepass directive:

sudo nano /etc/redis/redis.conf

requirepass YourStrongPasswordHere

Generate a good one with:

openssl rand -base64 32

After setting a password, connect with:

redis-cli -a YourStrongPasswordHere ping

Disable Dangerous Commands

Rename or disable commands that can cause data loss or system-level damage. In redis.conf:

rename-command FLUSHALL ""
rename-command FLUSHDB ""
rename-command CONFIG "CONFIG_b3f2a9"
rename-command DEBUG ""

This disables FLUSHALL and FLUSHDB entirely and renames CONFIG to a hard-to-guess string. Adjust the renamed string to something unique to your deployment.

Firewall Rules

If Redis is bound only to 127.0.0.1 you are already protected from external access. If you must expose port 6379 to a trusted LAN segment, lock it down at the firewall.

Ubuntu (ufw):

sudo ufw allow from 192.168.1.0/24 to any port 6379

Fedora / RHEL (firewalld):

sudo firewall-cmd --permanent --add-rich-rule='
  rule family="ipv4"
  source address="192.168.1.0/24"
  port port="6379" protocol="tcp" accept'
sudo firewall-cmd --reload

Arch / nftables directly:

sudo nft add rule inet filter input \
  ip saddr 192.168.1.0/24 tcp dport 6379 accept

Managing Redis with systemd

Beyond start/stop, systemd gives you resource controls you can apply without touching redis.conf. Use a drop-in override to keep your changes upgrade-safe.

sudo systemctl edit redis-server   # Debian/Ubuntu
sudo systemctl edit redis          # Fedora/Arch

In the editor that opens, add resource limits. The example below caps Redis to 2 CPU cores and enforces the memory ceiling at the OS level as a hard backstop:

[Service]
CPUQuota=200%
MemoryMax=1200M
Restart=on-failure
RestartSec=5s

Save and reload:

sudo systemctl daemon-reload
sudo systemctl restart redis-server   # or redis

Confirm the override is active:

systemctl show redis-server | grep -E 'MemoryMax|CPUQuota|Restart'

Reload Configuration Without a Restart

Many Redis configuration changes can be applied live using CONFIG SET and then persisted to disk with CONFIG REWRITE, avoiding a full service restart and its brief unavailability:

redis-cli -a YourStrongPasswordHere CONFIG SET maxmemory 2gb
redis-cli -a YourStrongPasswordHere CONFIG REWRITE

Changes that require a restart (such as switching AOF on/off or changing the bind address) must go through systemctl restart.

Verification

redis-cli -a YourStrongPasswordHere info server | head -20

Look for redis_version, uptime_in_seconds, tcp_port, and config_file in the output. Then confirm persistence is configured as expected:

redis-cli -a YourStrongPasswordHere info persistence

The fields aof_enabled and rdb_last_bgsave_status confirm your persistence choice took effect.

Troubleshooting

• Service fails to start: Run journalctl -xeu redis-server (or redis) and look for permission errors on the data directory (/var/lib/redis) or a port conflict on 6379. Check with ss -tlnp | grep 6379.
• NOAUTH error from redis-cli: You set requirepass but are not passing -a. Always include the password flag or set it in ~/.rediscli_authpass (chmod 600).
• Out-of-memory kills: If the Linux OOM killer terminates Redis before maxmemory is hit, lower maxmemory or raise MemoryMax in the systemd override to give Redis headroom for internal buffers (typically 10–20% above maxmemory).
• AOF file grows unbounded: Confirm auto-aof-rewrite-percentage and auto-aof-rewrite-min-size are set in redis.conf. Trigger a manual rewrite with redis-cli BGREWRITEAOF.
• Configuration changes ignored after restart: If both /etc/redis/redis.conf and /etc/redis.conf exist (common on RHEL), check which file the systemd unit actually passes to Redis: systemctl cat redis | grep ExecStart.