Redis ACLs: replace the open default user with scoped accounts

A default Redis instance has one user, called default, with no password, access to every key and every command. Redis 6 and later let you create named users with limited commands and key patterns, then lock the default user down. That turns a stolen connection from total access into a small, bounded one.

What the default looks like

The Redis ACL documentation shows the out of the box state with ACL LIST:

user default on nopass ~* &* +@all

Read it left to right. The user is on, needs no password, can touch all keys (~*), all Pub/Sub channels (&*) and every command (+@all). With nopass on the default user, new connections are authenticated automatically, with no AUTH call at all.

Create a user that can only do its job

New users start with nothing: off, no password, no commands, no keys. You add only what is needed. The documentation example gives a user read access to cache keys:

ACL SETUSER alice on >a-long-random-secret ~cached:* +get

Now GET cached:1234 works, GET foo fails on the key pattern, and SET cached:1234 x fails on the command. A worker that fetches queued jobs does not need FLUSHALL, FLUSHDB or SWAPDB, and an ACL is how you say so.

Rules are applied left to right, and repeated ACL SETUSER calls modify the existing user rather than resetting it. If you are unsure what a user can do, run ACL GETUSER and read the result instead of trusting your memory of past commands.

Use categories, and mind the traps

Listing commands one by one is tedious, so Redis offers categories. +@all -@dangerous allows everything except commands tagged dangerous, which the documentation says includes FLUSHALL, KEYS, CONFIG, DEBUG, SAVE and REPLICAOF. An additive allow list such as +@read is safer than a subtractive one, because commands added in future versions or by modules fall outside the categories you named.

Two traps from the documentation are worth remembering:

• Key patterns only restrict commands that name keys. A user with ~tenant1:* +@all can still run FLUSHALL and wipe every key, so remove it explicitly with -flushall -flushdb -swapdb.
• From Redis 7, acl-pubsub-default restricts Pub/Sub channels by default. Older upgrade paths kept allchannels, so check yours.

Lock down the default user

Once your apps authenticate as named users, change the default user so a bare connection can do nothing useful. You can switch it off or give it a long password. Test each application first, because anything still connecting unauthenticated will start failing. Keep the user definitions in an external ACL file referenced by aclfile, so they can be reviewed and reloaded with ACL LOAD.

Generate real passwords

The documentation notes that ACL passwords are shared secrets, not human passwords, and are stored as SHA-256 hashes so AUTH stays fast. Because of that, length matters more than any slow hashing. ACL GENPASS produces a 256 bit random value. Use it, and put the secret in your secret manager, not in the repository.

Quick check

Sources

• Redis documentation: ACL
• Redis documentation: Redis security

Last reviewed: 19 October 2026.