Security Interview Questions

bind 127.0.0.1 or a private interface; a Redis on 0.0.0.0:6379 without ACL is a public data store. Cloud security groups are not a substitute for bind. protected-mode exists because people still do this.

protected-mode, default on, refuses remote clients when no bind or ACL password is set. It is a seatbelt, not a security program. Disable it only when bind and ACL are correct.

AUTH with a single requirepass is shared-secret auth; ACL users in Redis 6+ give per-user command and key patterns. Prefer ACL. Rotating requirepass means bouncing every client at once.

TLS via tls-port and tls-cert-file encrypts traffic; AUTH without TLS still sends the password in clear on the network. Stunnel was the old pattern; native TLS is current. Internal VPC is not encryption.

rename-command or ACL to disable FLUSHALL, FLUSHDB, KEYS, DEBUG, and CONFIG. Compromised app creds should not wipe the dataset. Leave an admin user on a management interface.

Dangerous commands include CONFIG SET, REPLICAOF, MODULE LOAD, and DEBUG SEGFAULT. ACL category @dangerous exists for a reason. Application users get @read @write @hash, not +@all.

Network exposure: never publish 6379 to the internet, even with a password—old versions and brute force still exist. Use private subnets, sidecars, and TLS. Redis is not hardened like Postgres for hostile networks.

Redis as cache versus store of PII: a cache with allkeys-lru can drop data; PII still needs encryption, ACL, and audit. Putting sessions or personal data in Redis makes it a datastore for compliance. TTL is not a deletion-compliance story by itself.

ACL key patterns such as ~user:* limit which keys a microservice can touch. Combine with command rules. One shared default user for all apps is how a debug FLUSHALL takes down everything.

Command renaming in redis.conf, rename-command FLUSHALL to empty, is older than ACL but still seen. Empty rename disables the command. Document the admin path or you lock yourself out; ACL is the Redis 6+ replacement.

Replica security: replicas see the full dataset; an open replica is as bad as an open primary. Require replica-auth and masterauth. Do not expose replica ports publicly for read scaling.

Lua as an injection surface: never concatenate untrusted strings into EVAL scripts. Pass user input as ARGV and use redis.call with KEYS. EVAL of attacker-controlled source is game over.

MONITOR on a shared instance leaks every command including AUTH and SET of tokens. Restrict it with ACL. Debug on a copy of traffic, not production MONITOR.

Dangerous defaults in Docker: official images used to have no password. Always set ACL or requirepass via config. Compose files that publish 6379:6379 to the host are a finding.

Encryption at rest is not a Redis core feature; you encrypt the volume or use a managed offering. AOF and RDB on disk are plaintext commands and values. Disk snapshots of Redis are PII dumps.

Break-glass admin: a separate ACL user with +@all bound to a jump host, not baked into the app. Apps should not hold CONFIG permissions. Rotation and audit logs, if using managed Redis, matter.

SSRF and Redis: some clouds saw attackers hit metadata then Redis. Bind to localhost inside a locked namespace. Unix sockets for local-only access remove the TCP attack path.

Key naming that includes other tenants ids without ACL prefixes is an IDOR at the Redis layer. Enforce tenant in the key and in ACL patterns. Application filters are not enough if one client can GET any key.

Upgrade for security: old Redis had protocol issues and weaker ACLs. Managed patches still need you to drop requirepass-only setups. Track CVE notes for MODULE LOAD paths.

Compliance dump: RDB in S3 is a production dataset. Bucket ACLs and encryption belong in the Redis backup story. Treat persistence files as sensitive as a database export.