Redis "NOAUTH Authentication required": send the password, the right way for your client

1. Find the password

On the server, look in the config:

sudo grep -E '^(requirepass|aclfile|user )' /etc/redis/redis.conf

(/etc/redis.conf on RHEL, and sometimes /etc/redis/redis-server.conf.)

In Docker, it’s usually on the command line, or in an environment variable:

docker inspect redis --format '{{json .Config.Cmd}}'
docker exec redis env | grep -i redis

With Compose, check docker-compose.yml and .env. On Kubernetes, it’s in a Secret, often named after your Helm release:

kubectl get secret redis -o jsonpath='{.data.redis-password}' | base64 -d

2. Send it from redis-cli

Three ways:

redis-cli
> AUTH your-password
OK

REDISCLI_AUTH='your-password' redis-cli PING

redis-cli -a 'your-password' PING

The last one works, and prints a warning that the password can be seen in your process list and history. So it’s best kept for throwaway test servers. Quote the password in all of them, or characters such as $ and ! get interpreted by your shell.

-a and -h go before the command, and also work for a remote server: redis-cli -h 10.0.0.5 -p 6379 --user app --askpass.

3. Send it from your application

A URL is what most clients take:

redis://:your-password@10.0.0.5:6379/0
redis://app:your-password@10.0.0.5:6379/0     # with an ACL user (section 4)
rediss://:your-password@10.0.0.5:6380/0       # with TLS

The : in front of a password with no user is the classic mistake. Without it, the password is taken as a user name. Special characters need encoding too: @ becomes %40 and / becomes %2F. The URL encoder does this, and the Password Generator has a shell-safe option that doesn’t need it.

Or separately:

r = redis.Redis(host='10.0.0.5', port=6379, password='your-password')

const client = createClient({ url: 'redis://:your-password@10.0.0.5:6379' });

Then see if the app really got the value. A missing environment variable and an empty password send nothing at all, which gives NOAUTH. Test from the same place the app runs, as in a pod or container, as a different environment may have a different address.

4. ACL users, since Redis 6

Redis 6 added named users, and the old requirepass became the password of the default user. See who exists:

> ACL LIST
> ACL WHOAMI

Log in with a name:

> AUTH app your-password

Create a limited user for an application rather than sharing a single password:

> ACL SETUSER app on >your-password ~app:* +@read +@write -@dangerous
> ACL SAVE

ACL SAVE needs an aclfile set in the config. Otherwise, add the rule to redis.conf and run CONFIG REWRITE.

5. Related messages

(error) WRONGPASS invalid username-password pair or user is disabled.

You sent one, and it’s wrong. Check for an old value or a stray newline in the secret. A secret made with echo rather than echo -n has that extra character.

(error) ERR AUTH <password> called without any password configured for the default user. Are you sure your configuration is correct?

The reverse: the client sends a password, and the server has none. It’s harmless on old clients, but it means your server has no password, which is worth fixing.

(error) NOPERM this user has no permissions to run the 'config|set' command

You logged in, and this user may not do that.

6. Set or change the password

Without a restart:

> CONFIG SET requirepass "new-password"
> CONFIG REWRITE

CONFIG SET changes the running server, and CONFIG REWRITE keeps it across a restart. If that fails, add it to redis.conf:

requirepass new-password

Replicas need the password as well. Otherwise, they lose their connection, with this message in their log:

masterauth new-password

Sentinel has its own sentinel auth-pass mymaster new-password too.

7. Don’t forget the network

A password isn’t protection on its own. Redis handles huge numbers of attempts per second, so a weak password falls fast, and the traffic isn’t encrypted unless you’ve set up TLS.

Keep it on a private network, with bind 127.0.0.1 10.0.0.5 in redis.conf, and don’t publish 6379. In Compose, leave out ports: and let services connect by name. The Port Lookup has an entry on this.