Port 6379 – Redis

TCP

Port 6379 is the default Redis port. Redis by default has no authentication and binds to all interfaces – the most common Redis security mistake is exposing port 6379 to the internet. Redis 6+ supports TLS and ACL-based authentication. Always bind to localhost or use requirepass.

Port Number

6379

Protocol

TCP

Service

Redis In-Memory Store

Range

IANA Registered (1024–49151)

Description

Redis listens on port 6379 by default. Early Redis versions (pre-6) had no built-in TLS support and minimal authentication (just a shared password). Redis 6 introduced TLS, ACL-based user authentication, and improved security defaults. Production Redis should bind to 127.0.0.1 and use stunnel or TLS.

Security risks

1No-auth default: Redis ships without authentication enabled. An attacker who reaches port 6379 has full read/write/admin access including CONFIG SET, FLUSHALL, and DEBUG SEGFAULT (crash the server). Set requirepass in redis.conf immediately.
2RCE via CONFIG SET: attackers write a crontab or SSH key to disk using CONFIG SET dir /var/spool/cron/ + CONFIG SET dbfilename root + SET payload + BGSAVE. This is a well-known attack chain against exposed Redis. Rename dangerous commands: rename-command CONFIG '' in redis.conf.
3Data exfiltration: Redis stores all data in memory and responds instantly. An attacker who reaches 6379 can KEYS * and GET every key in seconds – session tokens, cached credentials, queue messages.
4Replication hijack: SLAVEOF command makes your Redis a replica of an attacker's server. The attacker's server sends a malicious RDB file that overwrites your data or executes module commands.

Firewall guidance

Never expose port 6379 to any untrusted network. Bind to 127.0.0.1 (bind 127.0.0.1 in redis.conf). If other hosts need access, use a private network with security groups allowing only application server IPs. Enable protected-mode yes (default since Redis 3.2) which refuses external connections when no password is set. For Sentinel (26379) and Cluster bus (16379), same rules apply.

Diagnosis commands

Basic connectivity test – should return PONG (or auth error if requirepass is set)

shell

redis-cli -h host -p 6379 PING

Check Redis version (determines available security features)

shell

redis-cli -h host -p 6379 INFO server | grep redis_version

Verify bind address configuration

shell

redis-cli -h host -p 6379 CONFIG GET bind

List configured ACL users (Redis 6+)

shell

redis-cli -h host -p 6379 ACL LIST

Usage examples

Port 6379 – Redis

shell

redis-cli -h localhost -p 6379
redis-cli -h localhost -p 6379 -a password
redis-cli --tls -h host -p 6380

Common services on this port

Redis OSSRedis EnterpriseAmazon ElastiCacheAzure Cache for RedisUpstashDragonflyKeyDBValkey

Related ports

6380

Redis TLS (common convention)

16379

Redis Cluster bus

26379

Redis Sentinel

History

Redis was created by Salvatore Sanfilippo in 2009. Port 6379 was chosen as it spells 'MERZ' on a phone keypad (an inside joke from an Italian pop star). Redis Labs (now Redis Inc) commercialized it. Redis 6 (2020) added ACLs and TLS. Redis 7 (2022) added Functions and improved multi-threading.

FAQ

Is Redis safe without authentication on localhost?

Only if your server has no other network-accessible services with vulnerabilities. A single SSRF vulnerability in any web app on the same machine gives attackers localhost access to Redis. Always set requirepass even on localhost as defense-in-depth.

Redis vs Memcached – security differences?

Memcached has no authentication at all (by design) and no TLS support without stunnel. Redis 6+ has ACLs and native TLS. Both should be on private networks only, but Redis at least has the option to require credentials.