Installing and Configuring Redis on VPS: Security and High Performance
TL;DR
In this detailed technical guide, we will step-by-step configure a high-performance and secure Redis server on your VPS. You will learn how to prepare the server, install the latest version of Redis, properly configure it for optimal performance and security, and set up backup and monitoring. All commands and configuration files are provided in a ready-to-copy and use format.
- Preparing a VPS with the latest Ubuntu 24.04 LTS OS, configuring SSH security and firewall.
- Installing Redis version 7.x from official repositories or compiling from source for maximum up-to-dateness.
- Detailed configuration of
redis.confwith an emphasis on security (password, IP binding) and performance (memory management, persistence). - Setting up automatic backup of Redis data and configuration.
- Effective troubleshooting of common problems and answers to frequently asked questions.
What We Configure and Why
Redis (Remote Dictionary Server) is a powerful, open-source in-memory data store used as a database, cache, and message broker. It supports various data structures such as strings, hashes, lists, sets, sorted sets with range queries, bitmaps, HyperLogLogs, geospatial indexes, and streams. By storing data in RAM, Redis provides incredibly high read and write speeds, making it an indispensable tool for modern high-load applications.
Within this guide, we will install and configure Redis on your Virtual Private Server (VPS) or dedicated server. The ultimate goal is to obtain a stable, secure, and performant Redis instance that can effectively serve your applications, whether it's a web application, microservice, gaming platform, or data processing system. You will learn not only basic installation but also fine-tuning of security parameters, memory management, and data persistence, which is critically important for a production environment.
What the reader will get in the end:
- A working Redis server, ready for integration with your applications.
- An understanding of key Redis configuration parameters affecting security and performance.
- Skills in basic Redis administration, including starting, stopping, monitoring, and backing up.
- A ready set of commands and scripts for quick deployment and maintenance.
What alternatives exist and why self-hosted on VPS:
There are several approaches to using Redis:
-
Cloud-managed Redis Services: Providers like Amazon ElastiCache, Google Cloud Memorystore, or Azure Cache for Redis offer fully managed Redis instances. They provide high availability, automatic scaling, backup, and patching without the need for manual intervention.
Pros: Ease of use, minimal administration, built-in fault tolerance.
Cons: High cost, less control over configuration, vendor lock-in to a specific cloud provider. -
Self-hosted Redis on VPS/Dedicated server: You install and manage Redis yourself on your virtual or dedicated server.
Pros: Full control over configuration, optimization for your needs, significantly lower cost compared to managed services, no vendor lock-in, ability to use specific Redis versions or modules.
Cons: Requires technical knowledge for installation, configuration, monitoring, and maintenance; responsibility for security and fault tolerance lies with you.
Choosing self-hosted Redis on a VPS is ideal for those who value full control, want to optimize costs, and possess sufficient technical skills for self-administration. This is an excellent option for developers, startups, crypto enthusiasts, and anyone who wants to maximize the efficient use of their server resources.
What VPS Configuration is Needed for This Task
VPS requirements for Redis heavily depend on the volume of data you plan to store in memory, the intensity of read/write operations, and the number of concurrently connected clients. Redis stores all data in RAM, making RAM the most critical resource.
Minimum requirements for small projects (cache for low-traffic website, small task queue):
- CPU: 1-2 vCPU (modern processor, e.g., Intel Xeon E3/E5 or AMD EPYC). Redis is single-threaded for most operations, but background tasks (persistence, AOF rewrite) can utilize other cores.
- RAM: 1-2 GB. This will be sufficient for storing several hundred megabytes of Redis data plus the operating system and other basic services.
- Disk: 20-40 GB SSD. SSD is critical for fast writing of persistent data (RDB snapshots, AOF log) and for quick data loading on restart.
- Network: 100 Mbps - 1 Gbps. For most cases, 100 Mbps is sufficient, but for high-load applications with many requests or large data object transfers, 1 Gbps will be required.
Recommended VPS plan for most tasks (medium traffic, several gigabytes of data, queues, pub/sub):
- CPU: 2-4 vCPU. Will provide sufficient performance for request processing and background operations.
- RAM: 4-8 GB. Will allow storing several gigabytes of Redis data, leaving a reserve for the OS and peak loads.
- Disk: 80-160 GB SSD. For larger data volumes and better persistence performance.
- Network: 1 Gbps. To ensure high bandwidth.
For such characteristics, you can get a VPS with the specified characteristics, which will allow effective use of Redis as a cache, message broker, or primary database for many applications.
When a dedicated server is needed, not a VPS:
A dedicated server becomes necessary when:
- Data volume exceeds available RAM: If you plan to store tens or hundreds of gigabytes of data in Redis.
- Maximum performance is required: For very high-load systems where every millisecond of latency is critical, as well as the complete absence of the "noisy neighbor effect" inherent in virtualization.
- High security and isolation requirements: A dedicated server provides complete physical isolation.
- Specific hardware requirements: For example, special disk types (NVMe), a large number of CPU cores, or very large amounts of RAM.
Location: what it affects
The choice of VPS geographical location has a direct impact on the latency between your application and the Redis server. The closer the Redis server is to your users or your application server, the lower the latency will be. For web applications, this means faster page responses; for game servers, smoother gameplay; for data processing systems, faster task execution.
If your application and Redis are in the same data center or at least in the same country, latency will be minimal (single-digit milliseconds). If they are located on different continents, latency can reach hundreds of milliseconds, which is unacceptable for many Redis use cases.
Server Preparation
Before installing Redis, you need to perform basic security configuration and update the operating system. We will use Ubuntu 24.04 LTS (Noble Numbat), which will be relevant in 2026 and is an excellent choice for stable production servers.
1. Connecting to the Server
Connect to your VPS via SSH using the credentials provided by your provider. This is usually the root user and password, or an SSH key.
ssh root@ВАШ_IP_АДРЕС
2. System Update
It is important to update all packages to the latest versions to ensure system security and stability.
sudo apt update && sudo apt upgrade -y
This command first updates the list of available packages (apt update), and then installs all available updates (apt upgrade -y, where -y automatically confirms all prompts).
3. Creating a New User with Sudo Privileges
Working as the root user is insecure. Let's create a new user and grant them sudo privileges.
sudo adduser redisadmin
Follow the instructions to set a password and fill in user information (you can leave it blank). Then add the new user to the sudo group:
sudo usermod -aG sudo redisadmin
Now you can switch to the new user and continue working:
su - redisadmin
Or open a new SSH connection as this user.
4. Configuring SSH Keys (Recommended)
Using SSH keys instead of passwords significantly enhances security. If you are not already using them, generate a key pair on your local machine and copy the public key to the server.
On your local machine:
ssh-keygen -t rsa -b 4096
ssh-copy-id redisadmin@ВАШ_IP_АДРЕС
After successfully copying the key, disable password authentication in the /etc/ssh/sshd_config file on the server. Open the file for editing:
sudo nano /etc/ssh/sshd_config
Find and change/add the following lines:
# Disable root login
PermitRootLogin no
# Disable password authentication
PasswordAuthentication no
# Enable public key authentication
PubkeyAuthentication yes
Save changes (Ctrl+O, Enter) and exit (Ctrl+X). Then restart the SSH service:
sudo systemctl restart sshd
IMPORTANT: Before disabling password authentication, ensure that you can log in with your SSH key by opening a new connection in another terminal. If key-based login does not work, you risk losing access to the server.
5. Firewall Configuration (UFW)
Uncomplicated Firewall (UFW) is an easy-to-use interface for iptables. It allows you to restrict access to ports on your server.
Allow SSH connections (usually port 22):
sudo ufw allow OpenSSH
If Redis will only be accessible locally (recommended), you do not need to open its port. However, if you plan to access it from other servers in your network (e.g., within a VPS provider's private network), open the Redis port (default 6379) for a specific IP address or subnet:
# Allow access to Redis from a specific IP
sudo ufw allow from 192.168.1.100 to any port 6379
# Or for the entire private subnet
sudo ufw allow from 10.0.0.0/8 to any port 6379
Activate the firewall:
sudo ufw enable
Confirm the action by typing y. Check the firewall status:
sudo ufw status
6. Installing Fail2ban
Fail2ban scans logs and blocks IP addresses showing signs of malicious attacks (e.g., numerous failed SSH login attempts). This provides an additional layer of security.
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
Create a copy of the default configuration file for customization:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Edit jail.local to configure ban parameters if necessary. For example, you can increase bantime (ban time) or decrease maxretry (number of attempts).
sudo nano /etc/fail2ban/jail.local
Find the [DEFAULT] section and configure:
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
Restart Fail2ban to apply the changes:
sudo systemctl restart fail2ban
Your server is now basically secured and ready for Redis installation.
Software Installation — Step-by-Step
We will install Redis version 7.x, which will be current and stable in 2026. There are two main installation methods: from official Ubuntu repositories or compilation from source. For most users, installing from repositories is simpler and more reliable, providing automatic security updates. However, if you need the very latest version or specific compilation options, building from source might be preferable. We will cover both options, starting with the recommended one.
Option 1: Installing Redis from Ubuntu Repositories (Recommended)
This method is simple and provides a stable, tested version of Redis. Ubuntu 24.04 LTS will likely come with Redis 7.x or newer.
Step 1: Update Package List
Ensure the package list is updated to get the latest information about available Redis versions.
sudo apt update
# Updates the package index from repositories
Step 2: Install Redis Server
Install the redis-server package. This command will install Redis and all necessary dependencies, and also configure it as a system service.
sudo apt install redis-server -y
# Installs Redis Server and automatically starts it
Step 3: Check Redis Service Status
After installation, Redis should start automatically. Let's check its status:
sudo systemctl status redis-server
# Checks if the Redis service is running
The output should show "active (running)". If not, try starting it manually:
sudo systemctl start redis-server
# Starts the Redis service
Step 4: Check Redis Version
Ensure the expected Redis version is installed (presumably 7.x).
redis-server --version
# Outputs the version of installed Redis
You will see something like Redis server v=7.x.y sha=...
Step 5: Check Redis Connection
Use the redis-cli client to check the connection to the Redis server.
redis-cli ping
# Sends a PING command to the Redis server
In response, you should receive PONG, indicating a successful connection.
Option 2: Compiling Redis from Source (For Advanced Users)
This method allows you to install the very latest version of Redis (e.g., Redis 8.x, if available by 2026) or use specific compilation options. It requires installing build tools.
Step 1: Install Necessary Build Tools
Install the packages required for compiling software from source.
sudo apt install build-essential tcl -y
# Installs compilers (gcc, make) and tcl for tests
Step 2: Download Redis Source Code
Navigate to a temporary directory and download the latest stable version of Redis from the official website. For example, we use version 7.2.4, but you can replace it with the most current version for 2026.
cd /tmp
wget https://download.redis.io/releases/redis-7.2.4.tar.gz
# Downloads the Redis source archive
tar xzf redis-7.2.4.tar.gz
# Unpacks the archive
cd redis-7.2.4
# Changes to the source directory
Step 3: Compile and Install Redis
Compile Redis. Use make, then make install to install the executables into system directories.
make
# Compiles Redis
sudo make install
# Installs Redis to /usr/local/bin
Step 4: Configure Redis as a systemd Service
For Redis to run as a system service and be managed via systemctl, configuration files need to be created. Run a special script that will help with this.
sudo ./utils/install_server.sh
# Runs an interactive script to configure systemd and configuration files
Follow the script's instructions. For most questions, you can press Enter to accept the default values (e.g., port 6379, configuration file /etc/redis/6379.conf, log file /var/log/redis_6379.log, data directory /var/lib/redis/6379). After completion, the script will start Redis and configure it for autostart.
Step 5: Check Redis Service Status
Check that Redis is running and active:
sudo systemctl status redis_6379
# Checks the status of the Redis service created by the script (can be redis-server or redis_6379)
Or, if the script created a service named redis-server:
sudo systemctl status redis-server
Step 6: Check Version and Connection
redis-cli ping
# Checks connection to Redis
redis-cli info server | grep redis_version
# Outputs Redis version
Redis is now installed. Let's move on to its detailed configuration for security and optimal performance.
Configuration
The Redis configuration file is typically located at /etc/redis/redis.conf (for installations from repositories) or /etc/redis/6379.conf (if you used the install_server.sh script). We will use redis.conf for all examples.
Open the configuration file for editing:
sudo nano /etc/redis/redis.conf
1. Security
1.1. IP Address Binding (bind)
By default, Redis can listen on all available network interfaces. This is dangerous. Restrict it to listen only on the local interface (127.0.0.1) if your application runs on the same server, or a specific private IP address if Redis is accessible from the local network.
Find the line bind 127.0.0.1 -::1 and ensure it is uncommented. If you need access from other servers in a private network, specify their IP addresses or the private IP of your Redis server.
# By default, listen only on localhost
bind 127.0.0.1 -::1
# If you need to listen on a private IP, for example, 10.0.0.5
# bind 10.0.0.5
# If you need to listen on multiple IPs
# bind 127.0.0.1 10.0.0.5
# Uncomment this line if you want Redis to listen on all interfaces (HIGHLY NOT RECOMMENDED WITHOUT FIREWALL CONFIGURATION)
# bind 0.0.0.0
For most cases, when the application and Redis are on the same VPS, bind 127.0.0.1 -::1 is the safest option.
1.2. Setting a Password (requirepass)
Redis does not have authentication by default. Setting a password is a critically important security measure.
Find the line starting with # requirepass foobared. Uncomment it and replace foobared with a strong, complex password. Generate passwords at least 32 characters long.
requirepass YOUR_STRONG_REDIS_PASSWORD
Important: Never use simple passwords. Record the password in a secure location or use a password manager.
1.3. Renaming or Disabling Dangerous Commands (rename-command)
Some Redis commands (e.g., FLUSHALL, FLUSHDB, KEYS, CONFIG) can be dangerous if misused. You can rename them or disable them entirely.
# Disable a command (make it unavailable)
rename-command FLUSHALL ""
rename-command FLUSHDB ""
# Rename a command (make it available under a different name)
rename-command CONFIG CONFIG_HIDDEN
If you disable a command, ensure that your applications do not depend on it, or that they use its safe equivalents.
2. Performance and Memory Management
2.1. Maximum Memory (maxmemory)
Redis stores data in RAM. Set a memory limit to prevent exhausting all available RAM and crashing the server. It is recommended to allocate 50-70% of the total available RAM on your VPS for Redis, to leave space for the OS and other processes.
For example, if you have 4GB RAM, you can allocate 2.5GB for Redis.
maxmemory 2.5gb
2.2. Eviction Policy (maxmemory-policy)
When Redis reaches maxmemory, it needs to decide which data to remove to free up space for new data. There are various eviction policies:
noeviction: New writes are not accepted if memory is full.allkeys-lru: Removes the least recently used (LRU) keys from the entire set.volatile-lru: Removes LRU keys only from those that have a TTL (time to live).allkeys-lfu: Removes the least frequently used (LFU) keys from the entire set.volatile-lfu: Removes LFU keys only from those that have a TTL.allkeys-random: Removes random keys from the entire set.volatile-random: Removes random keys only from those that have a TTL.volatile-ttl: Removes keys with the shortest remaining TTL.
For a cache, allkeys-lru or allkeys-lfu are usually good choices.
maxmemory-policy allkeys-lru
2.3. Persistence
Redis can save data to disk so that it is not lost when the server restarts. There are two main mechanisms:
-
RDB (Redis Database Backup): Takes snapshots of data at specified intervals. Fast for recovery, but can lead to data loss recorded between snapshots.
# Save if at least 10000 keys changed in 60 seconds save 60 10000 # Save if at least 1000 keys changed in 300 seconds save 300 1000 # Save if at least 1 key changed in 900 seconds save 900 1 -
AOF (Append Only File): Records every write operation to a log file. Provides better data durability, but can be slower and consume more disk space.
appendonly yes appendfsync everysec # Save AOF to disk every second
You can use both mechanisms simultaneously. For maximum data durability, AOF with appendfsync everysec is recommended. For a pure cache that can be rebuilt from another source, persistence can be disabled (comment out all save lines and set appendonly no).
3. Logging
Ensure that logging is configured to track Redis events.
logfile /var/log/redis/redis-server.log
loglevel notice
Ensure that the directory /var/log/redis/ exists and Redis has write permissions to it. If not, create it:
sudo mkdir -p /var/log/redis
sudo chown redis:redis /var/log/redis
4. Saving and Restarting Redis
After making all changes to redis.conf, save the file (Ctrl+O, Enter) and exit (Ctrl+X). Then restart the Redis service to apply the new settings.
sudo systemctl restart redis-server
# Restarts the Redis service
5. Verifying Operation with the New Configuration
After restarting, check the service status and ensure that Redis is running without errors.
sudo systemctl status redis-server
Now try connecting with a password via redis-cli:
redis-cli -a YOUR_STRONG_REDIS_PASSWORD ping
# Connects to Redis with authentication and sends PING
You should receive PONG. If you have renamed or disabled commands, ensure they behave as expected.
# Attempt to execute a disabled command (should return an error)
redis-cli -a YOUR_STRONG_REDIS_PASSWORD FLUSHALL
# Attempt to execute a renamed command (should return an error)
redis-cli -a YOUR_STRONG_REDIS_PASSWORD CONFIG GET *
# Correct call of the renamed command
redis-cli -a YOUR_STRONG_REDIS_PASSWORD CONFIG_HIDDEN GET *
If Redis is configured to listen on a private IP, ensure that you can connect from another server using that IP and port 6379, as well as the password.
