Disable/Restrict Dangerous Administration, Protect CONFIG/MODULE-Like Capabilities, and Network Access

Learning outcomes

This lesson turns Disable/Restrict Dangerous Administration, Protect CONFIG/MODULE-Like Capabilities, and Network Access into an observable AtlasMart workflow with explicit correctness, failure, and production boundaries.

1. Problem: a TLS administrator can still destroy the service

TLS and a correct password do not make every authenticated command safe. A Redis identity that can run CONFIG, MODULE, DEBUG, SHUTDOWN, replication-role changes, or broad ACL commands can alter server behavior or execute highly privileged operations. Security therefore needs a control-plane permission model plus network/process hardening, not only “encrypted AUTH.”

2. Redis administrative capabilities are explicit ACL territory

Redis labels administrative/dangerous commands in its command table. Normal applications should not need them. The current security guidance prefers ACL restrictions to the old practice of renaming a few famous commands. Command renaming is deprecated and brittle because tooling, modules, scripts, and future commands can bypass the mental list.

3. Keep startup protections closed unless a measured local need exists

Redis has startup hardening switches for sensitive configuration, DEBUG, and MODULE capabilities. This chapter keeps enable-protected-configs no, enable-debug-command no, and enable-module-command no. These server-level protections complement ACLs; they are not a replacement for restricting the application user.

docker exec -e REDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026 atlasmart-redis-ch22-primary \  redis-cli --tls --cacert /certs/ca.crt --cert /certs/client.crt --key /certs/client.key --user academy-admin -p 6379 \  CONFIG GET bind protected-mode port tls-port enable-protected-configs enable-debug-command enable-module-command

4. Prove dangerous commands are denied without executing them

ACL DRYRUN is the correct tool for testing a dangerous permission boundary because it does not run the target command. The application must be denied CONFIG, MODULE, DEBUG, SHUTDOWN, ACL mutation, role change, and global flush commands. This checks Redis ACL policy; it does not test host/container privilege.

export REDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026A="./ch22-cli.sh"$A ACL DRYRUN atlasmart-app CONFIG GET maxmemory$A ACL DRYRUN atlasmart-app MODULE LIST$A ACL DRYRUN atlasmart-app DEBUG HELP$A ACL DRYRUN atlasmart-app SHUTDOWN$A ACL DRYRUN atlasmart-app ACL LIST$A ACL DRYRUN atlasmart-app REPLICAOF NO ONE$A ACL DRYRUN atlasmart-app FLUSHALL

5. Operator inspection is not operator mutation

The Chapter 22 operator can read selected configuration and client/latency/slowlog state but cannot CONFIG SET or ACL SETUSER. This permits evidence collection without granting the on-call dashboard a direct path to modify server security. If an operator workflow truly needs a mutation, add the exact command after review rather than escalating to +@admin by default.

export REDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026A="./ch22-cli.sh"$A ACL DRYRUN atlasmart-operator CONFIG GET maxmemory$A ACL DRYRUN atlasmart-operator CLIENT LIST$A ACL DRYRUN atlasmart-operator CONFIG SET maxmemory 64mb$A ACL DRYRUN atlasmart-operator ACL SETUSER atlasmart-app off

6. Network boundary: bind, protected mode, publish only what must be reachable

Redis is designed for trusted environments and should not be directly exposed to the internet. In this lab, the plaintext ACL node is loopback-only and the TLS primary is also published only on loopback; the replica has no host port. Inside Docker, bind 0.0.0.0 is necessary for container peer connectivity, so host port publishing and private network membership are part of the boundary. protected-mode is defense-in-depth, not permission to expose Redis broadly.

docker port atlasmart-redis-ch22-primary 6379docker port atlasmart-redis-ch22-replica 6379 || truedocker network inspect atlasmart-redis-ch22-netREDISCLI_AUTH=AtlasMart-Ch22-Admin-Lab-Only-2026 ./ch22-cli.sh CONFIG GET bind protected-mode port tls-port

7. Do not use this lesson to change the host firewall

Production network enforcement may involve host firewalls, cloud security groups, Kubernetes NetworkPolicies, service meshes, or private subnets. The mandatory lab deliberately avoids broad host firewall/sysctl changes. Observe Docker’s exact loopback/private-network state, then map the principle to your platform with infrastructure-as-code and review.

8. MODULE-like capabilities need both server and ACL controls

MODULE LOAD is administrative/dangerous and can introduce new code/commands. Redis 8 increasingly integrates former modules into the server, but third-party module loading remains a privileged capability. Keep enable-module-command no unless an explicit deployment procedure needs runtime module commands; prefer startup-managed modules and a separate release process. Remember that +@all can include module commands, which is another reason applications should not receive it.

9. Configuration writes can persist beyond the process

CONFIG SET changes runtime configuration; CONFIG REWRITE can persist supported settings to a config file. A user that can write protected configs or filesystem-sensitive directives may affect files/process behavior. Treat configuration access as control-plane privilege, back up/review the intended config separately, and never rely on a command rename as the only guard.

10. Deliberately wrong: “rename CONFIG and FLUSHALL”

Renaming only a few commands is a denylist that drifts with the server’s control surface and can break clients/operations. Redis security guidance now deprecates this technique. Repair with default-deny ACL users, startup protections, network segmentation, and reviewed operator workflows. Keep a break-glass administrator separate and monitor its use.

11. Observability signals and limitations

Inspect ACL LOG for denied admin attempts, CLIENT LIST for unexpected users/addresses/names, server logs for TLS/auth/config/module errors, and configuration diffs at deploy time. Redis ACL LOG is not a durable audit ledger. Export the evidence you need to a protected external system and avoid logging clear secrets.

12. Production judgment and bridge

Security hardening is layered: untrusted clients should not reach Redis; reachable clients should use verified TLS; connections authenticate as named identities; identities get least privilege; startup protections constrain dangerous capabilities; hosts/containers run with minimal OS privilege; and operations produce external audit evidence. Lesson 5 turns this into a repeatable secret-rotation and incident-response workflow.

Summary and next step

Disable/Restrict Dangerous Administration, Protect CONFIG/MODULE-Like Capabilities, and Network Access is now connected to observable Redis behavior, bounded failure cases, and production tradeoffs. Keep the evidence and cleanup state from this lesson; next, continue with Secrets Rotation, Audit/Connection Evidence, Backups, and Incident Response for Credential Exposure.

Authoritative references

• Redis security
• Redis ACL tutorial
• ACL SETUSER
• ACL GETUSER
• ACL LIST
• ACL WHOAMI
• ACL CAT
• ACL DRYRUN
• ACL LOG
• ACL SAVE
• ACL LOAD
• AUTH
• Redis TLS
• CLIENT LIST
• CLIENT KILL
• CONFIG GET
• CONFIG SET
• MODULE LOAD
• Redis replication — ACL authentication
• Redis Sentinel — ACL authentication
• Redis Cluster specification
• Redis 8.10 release notes
• Redis 8.10 — what is new
• Redis licenses
• Docker Official Image — Redis