Configure Redis 7 cluster sharding with SSL/TLS authentication and security hardening

Update system packages

Start by updating your package manager to ensure you have the latest Redis and security packages.

sudo apt update && sudo apt upgrade -y
sudo apt install -y redis-server redis-tools openssl

sudo dnf update -y
sudo dnf install -y redis redis-cli openssl

Create SSL certificate authority

Generate a self-signed CA certificate for securing Redis cluster communications and client connections.

sudo mkdir -p /etc/redis/ssl
cd /etc/redis/ssl
sudo openssl genrsa -out ca-key.pem 4096
sudo openssl req -x509 -new -nodes -key ca-key.pem -sha256 -days 3650 -out ca-cert.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=IT/CN=Redis-CA"

Generate server certificates for each node

Create individual SSL certificates for each Redis cluster node to enable mutual TLS authentication.

for i in {1..6}; do
  sudo openssl genrsa -out redis-server-${i}-key.pem 2048
  sudo openssl req -new -key redis-server-${i}-key.pem -out redis-server-${i}.csr -subj "/C=US/ST=State/L=City/O=Organization/OU=IT/CN=redis-node-${i}"
  sudo openssl x509 -req -in redis-server-${i}.csr -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out redis-server-${i}-cert.pem -days 365 -sha256
  sudo rm redis-server-${i}.csr
done

Set certificate permissions

Configure secure file ownership and permissions for SSL certificates to prevent unauthorized access.

sudo chown -R redis:redis /etc/redis/ssl
sudo chmod 600 /etc/redis/ssl/*-key.pem
sudo chmod 644 /etc/redis/ssl/*-cert.pem /etc/redis/ssl/ca-cert.pem

Create cluster node directories

Set up separate data directories for each Redis cluster node with proper ownership and permissions.

for i in {1..6}; do
  sudo mkdir -p /var/lib/redis/cluster-${i}
  sudo mkdir -p /etc/redis/cluster-${i}
  sudo mkdir -p /var/log/redis/cluster-${i}
done
sudo chown -R redis:redis /var/lib/redis/cluster-*
sudo chown -R redis:redis /etc/redis/cluster-*
sudo chown -R redis:redis /var/log/redis/cluster-*

Configure first cluster node

Create the Redis configuration for the first master node with SSL, authentication, and cluster settings.

port 0
tls-port 7001
tls-cert-file /etc/redis/ssl/redis-server-1-cert.pem
tls-key-file /etc/redis/ssl/redis-server-1-key.pem
tls-ca-cert-file /etc/redis/ssl/ca-cert.pem
tls-dh-params-file /etc/redis/ssl/redis.dh
tls-protocols "TLSv1.2 TLSv1.3"
tls-ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
tls-prefer-server-ciphers yes

bind 0.0.0.0
requirepass StrongRedisPassword2024!
masterauth StrongRedisPassword2024!

cluster-enabled yes
cluster-config-file /var/lib/redis/cluster-1/nodes.conf
cluster-node-timeout 15000
cluster-announce-hostname redis-node-1
cluster-announce-port 7001
cluster-announce-tls-port 7001
cluster-require-full-coverage no

dir /var/lib/redis/cluster-1/
logfile /var/log/redis/cluster-1/redis.log
loglevel notice

save 900 1
save 300 10
save 60 10000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb

appendonly yes
appendfsync everysec
no-appendfsync-on-rewrite no
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 64mb

maxmemory-policy allkeys-lru
maxclients 10000
tcp-keepalive 300
timeout 0

protected-mode yes
tcp-backlog 511
databases 1

Generate Diffie-Hellman parameters

Create DH parameters for enhanced SSL security across all cluster nodes.

sudo openssl dhparam -out /etc/redis/ssl/redis.dh 2048
sudo chown redis:redis /etc/redis/ssl/redis.dh
sudo chmod 644 /etc/redis/ssl/redis.dh

Create remaining cluster node configurations

Generate Redis configurations for the remaining 5 cluster nodes with unique ports and certificates.

for i in {2..6}; do
  sudo cp /etc/redis/cluster-1/redis.conf /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/tls-port 700[0-9]/tls-port 700${i}/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/redis-server-[0-9]-cert.pem/redis-server-${i}-cert.pem/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/redis-server-[0-9]-key.pem/redis-server-${i}-key.pem/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/cluster-[0-9]/cluster-${i}/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/redis-node-[0-9]/redis-node-${i}/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/announce-port 700[0-9]/announce-port 700${i}/g" /etc/redis/cluster-${i}/redis.conf
  sudo sed -i "s/announce-tls-port 700[0-9]/announce-tls-port 700${i}/g" /etc/redis/cluster-${i}/redis.conf
done

Create systemd service files

Configure systemd services for each Redis cluster node with proper isolation and security.

for i in {1..6}; do
sudo tee /etc/systemd/system/redis-cluster-${i}.service > /dev/null <Security settings
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/redis/cluster-${i} /var/log/redis/cluster-${i} /etc/redis/cluster-${i}
CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
MemoryDenyWriteExecute=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictNamespaces=true

[Install]
WantedBy=multi-user.target
EOF
done

Enable and start cluster nodes

Start all Redis cluster nodes with SSL/TLS encryption enabled and verify they're running properly.

sudo systemctl daemon-reload
for i in {1..6}; do
  sudo systemctl enable redis-cluster-${i}
  sudo systemctl start redis-cluster-${i}
done

Check all nodes are running
for i in {1..6}; do
  sudo systemctl status redis-cluster-${i} --no-pager -l
done

Configure cluster authentication

Set up Redis ACL users with specific permissions for cluster operations and client access.

# Connect to first node and configure ACL
redis-cli --tls \
  --cert /etc/redis/ssl/redis-server-1-cert.pem \
  --key /etc/redis/ssl/redis-server-1-key.pem \
  --cacert /etc/redis/ssl/ca-cert.pem \
  -p 7001 -a StrongRedisPassword2024! <ClusterAdminPass2024! allcommands allkeys
ACL SETUSER app-user ON >AppUserPass2024! +@read +@write +@keyspace +@string +@hash +@list +@set +@sortedset +@bitmap +@hyperloglog +@geo +@stream ~app:*
ACL SETUSER readonly-user ON >ReadOnlyPass2024! +@read ~*
ACL SAVE
EOF

Initialize Redis cluster

Create the Redis cluster with 3 master nodes and 3 replica nodes using SSL connections.

redis-cli --tls \
  --cert /etc/redis/ssl/redis-server-1-cert.pem \
  --key /etc/redis/ssl/redis-server-1-key.pem \
  --cacert /etc/redis/ssl/ca-cert.pem \
  --cluster create 127.0.0.1:7001 127.0.0.1:7002 127.0.0.1:7003 127.0.0.1:7004 127.0.0.1:7005 127.0.0.1:7006 \
  --cluster-replicas 1 -a StrongRedisPassword2024! --cluster-yes

Configure firewall rules

Open only the necessary ports for Redis cluster communication with specific source restrictions.

sudo ufw allow from 203.0.113.0/24 to any port 7001:7006 proto tcp comment 'Redis cluster SSL'
sudo ufw allow from 203.0.113.0/24 to any port 17001:17006 proto tcp comment 'Redis cluster bus'
sudo ufw reload

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port protocol="tcp" port="7001-7006" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port protocol="tcp" port="17001-17006" accept'
sudo firewall-cmd --reload

Verify cluster status

Check that all cluster nodes are properly connected and the hash slots are distributed correctly.

redis-cli --tls \
  --cert /etc/redis/ssl/redis-server-1-cert.pem \
  --key /etc/redis/ssl/redis-server-1-key.pem \
  --cacert /etc/redis/ssl/ca-cert.pem \
  -p 7001 -a StrongRedisPassword2024! \
  cluster info

redis-cli --tls \
  --cert /etc/redis/ssl/redis-server-1-cert.pem \
  --key /etc/redis/ssl/redis-server-1-key.pem \
  --cacert /etc/redis/ssl/ca-cert.pem \
  -p 7001 -a StrongRedisPassword2024! \
  cluster nodes

Test data distribution

Verify that data is automatically sharded across cluster nodes using hash slot distribution.

# Test writing data to different keys
for i in {1..10}; do
  redis-cli --tls \
    --cert /etc/redis/ssl/redis-server-1-cert.pem \
    --key /etc/redis/ssl/redis-server-1-key.pem \
    --cacert /etc/redis/ssl/ca-cert.pem \
    -c -p 7001 -a StrongRedisPassword2024! \
    SET "test:key:${i}" "value${i}"
done

Verify data retrieval
for i in {1..10}; do
  redis-cli --tls \
    --cert /etc/redis/ssl/redis-server-1-cert.pem \
    --key /etc/redis/ssl/redis-server-1-key.pem \
    --cacert /etc/redis/ssl/ca-cert.pem \
    -c -p 7001 -a StrongRedisPassword2024! \
    GET "test:key:${i}"
done

Set up monitoring scripts

Create monitoring scripts to track cluster health, memory usage, and connection statistics.

#!/bin/bash
CERT_PATH="/etc/redis/ssl/redis-server-1-cert.pem"
KEY_PATH="/etc/redis/ssl/redis-server-1-key.pem"
CA_PATH="/etc/redis/ssl/ca-cert.pem"
PASSWORD="StrongRedisPassword2024!"
LOG_FILE="/var/log/redis/cluster-health.log"

echo "$(date): Starting Redis cluster health check" >> $LOG_FILE

for port in {7001..7006}; do
    echo "Checking node on port $port:"
    
    # Check if node is responding
    if redis-cli --tls --cert $CERT_PATH --key $KEY_PATH --cacert $CA_PATH -p $port -a $PASSWORD ping > /dev/null 2>&1; then
        echo "  Node $port: ONLINE"
        
        # Get memory info
        MEMORY=$(redis-cli --tls --cert $CERT_PATH --key $KEY_PATH --cacert $CA_PATH -p $port -a $PASSWORD info memory | grep used_memory_human | cut -d: -f2 | tr -d '\r')
        echo "  Memory usage: $MEMORY"
        
        # Get connection count
        CONNECTIONS=$(redis-cli --tls --cert $CERT_PATH --key $KEY_PATH --cacert $CA_PATH -p $port -a $PASSWORD info clients | grep connected_clients | cut -d: -f2 | tr -d '\r')
        echo "  Connections: $CONNECTIONS"
    else
        echo "  Node $port: OFFLINE" | tee -a $LOG_FILE
    fi
    echo
done

Check overall cluster status
CLUSTER_STATE=$(redis-cli --tls --cert $CERT_PATH --key $KEY_PATH --cacert $CA_PATH -p 7001 -a $PASSWORD cluster info | grep cluster_state | cut -d: -f2 | tr -d '\r')
echo "Cluster state: $CLUSTER_STATE"

if [ "$CLUSTER_STATE" != "ok" ]; then
    echo "$(date): ALERT - Cluster state is not OK: $CLUSTER_STATE" >> $LOG_FILE
fi

Make monitoring script executable and schedule

Set up automated cluster health monitoring with cron scheduling and proper logging.

sudo chmod 755 /usr/local/bin/redis-cluster-monitor.sh
sudo chown redis:redis /usr/local/bin/redis-cluster-monitor.sh

Create log directory
sudo mkdir -p /var/log/redis
sudo chown redis:redis /var/log/redis
sudo chmod 755 /var/log/redis

Add to crontab for redis user
sudo -u redis crontab -l 2>/dev/null | { cat; echo "/5    * /usr/local/bin/redis-cluster-monitor.sh"; } | sudo -u redis crontab -