Port 6379 (Redis)

What port 6379 is

TCP port 6379 is the default port of Redis and of compatible servers such as Valkey and KeyDB. Clients send plain-text RESP commands, and by default nothing is encrypted. Related ports:

Should it be open to the internet?

No. Redis was designed for trusted networks. An exposed instance without a password lets anyone read and delete every key, and attackers have long abused CONFIG SET to write files on the server (for example an SSH authorized_keys file or a cron job) and take it over. Internet-wide scans find open Redis servers constantly, and many are compromised within hours.

Locking it down in redis.conf

Recent versions ship a safe default config. Check these lines:

bind 127.0.0.1 -::1
protected-mode yes
port 6379
requirepass a-long-random-password
rename-command CONFIG ""

• bind limits the interfaces. Add a private address only if other servers need it.
• protected-mode (Redis 3.2 and later) refuses outside connections when there is no password and no explicit bind.
• requirepass sets the password for the default user. On Redis 6 and later, prefer ACLs, with one user per application and only the commands it needs:

user default off
user app on >another-long-password ~cache:* +@read +@write -@dangerous

• rename-command can disable commands like CONFIG and FLUSHALL; in ACL setups, deny them with -@dangerous instead.

Restart Redis after editing, then confirm with redis-cli CONFIG GET bind (if CONFIG is still allowed for your admin user).

TLS

Redis 6 and later can serve TLS when built with it, on a separate port:

port 0
tls-port 6379
tls-cert-file /etc/redis/tls/redis.crt
tls-key-file  /etc/redis/tls/redis.key
tls-ca-cert-file /etc/redis/tls/ca.crt

Managed Redis services usually offer TLS with a provider-specific port; check their connection details.

Firewall rules

sudo ufw allow from 192.0.2.20 to any port 6379 proto tcp

sudo iptables -A INPUT -p tcp -s 192.0.2.20 --dport 6379 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 6379 -j DROP

The official Docker image does not use the default config file and listens on all interfaces, without a password and with protected mode turned off. Publish it on loopback only (-p 127.0.0.1:6379:6379), or not at all when only other containers need it. Ports published on all interfaces bypass ufw on most Linux hosts.

How to check what is listening

sudo ss -tlnp | grep ':6379'
sudo lsof -i :6379
redis-cli -h 127.0.0.1 -p 6379 ping

PONG means it answered; NOAUTH Authentication required means a password is set. To test from outside, run redis-cli -h db.example.com ping from another network: it should time out or be refused.

"Port 6379 already in use"

Usually a system Redis service and a Docker container at the same time. Stop one (sudo systemctl stop redis-server on Debian and Ubuntu), or map the container elsewhere with -p 127.0.0.1:6380:6379.

Related ports

• Port 5432: PostgreSQL.
• Port 3306: MySQL.
• Port 27017: MongoDB, another database often found exposed.

Make sure 6379 isn't reachable from the public internet with the Port Scanner.