Redis raises "NOAUTH Authentication required" error but there is no password setting

Question

I got error NOAUTH Authentication required when I connect to Redis server via command: redis-cli and run ping to check if Redis is working.

I found answer for NOAUTH Authentication required error which describes that this error only happens when Redis is set a password, but I checked Redis config file at etc/redis/redis.conf and there is no password setting.

Does anyone know that if there are other settings which can cause this error? Thanks for any help.

p/s: I am using Ruby on Rails web framework, Redis database is used for Sidekiq.

Edited: Redis version is 2.8.4. Server is hosted on AWS.

Currently, I decided to set a password for Redis server so that it can not be set password when it is running.

(When Redis server is restarted, it will work normal. You can run sudo service redis-server restart to restart Redis server.)

Solution 1

We also faced a similar issue. Looks like someone scanned AWS, connected to all public redis servers, and possibly ran "CONFIG SET REQUIREPASS ''", thus locking down the running instance of redis. Once you restart redis, the config is restored to normal.

Best thing would be to use AWS security group policy and block port 6379 for public.

Solution 2

I'm running Redis with Docker and there is an authentication password with the REDIS_PASSWORD env variable.

After connecting to the container with docker exec command, connect to redis CLI by entering the redis-cli command.

Then enter auth {password}, (the password that is set with the REDIS_PASSWORD)

Solution 3

I had the same issue (running on AWS) and discovered our redis port was exposed. You probably had the same. Someone was messing around.

EDIT: The solution: reset your redis password and then (assuming you have it running as a service) restart the service providing the new password

Solution 4

Had the exact same problem running Redis on an AWS instance. I would restart redis-server without any password requirements (#requirepass ''), would work fine for a few hours, then would throw "NOAUTH Authentication required" and eventually would have to restart redis-server.

Checked the Security Groups settings in AWS for the instance and saw port 6379 open to the public (0.0.0.0/0). We limited the port access to our only server that needs to access and haven't seen the issue come up ever since!

P.S. This is my first ever contribution to StackOverflow. Thanks for the help!

Solution 5

I Have the same problem. after that I'm set requirepass for the redis server.
And add that password in initializer/redis.rb

$redis = Redis.new(:password=>"****") 

It works fine

View more solutions

Comments

[Thanh]

I did not make any change, the Redis server require a password when it is running while configuration is not set password.

[Thanh]

Yes, I restarted server and it works normal but then stuck again. So I decided to set a password for it so that it can not set new password again.

[haren]

Do you have your redis port (presumably 6379) exposed to the world? Closing it is the first step in the solution.

[Thanh]

Yes, maybe the server is not protected port 6379 of redis. My solution is set a password for redis server so it can not be override password.

[Felipe Zavan]

In my case, the troll cleared the database (ran FLUSHALL), then ran CONFIG SET REQUIREPASS '', twice. Luckily I had backups, thank you for pointing the exact vunerability that allowed him to do this, and how to fix it.

[DataGreed]

Seems like the very reasonable explanation, had same problem on AWS

[Thanh]

you should also limit connect to your Redis port if your server is installed on AWS.

[Kohanz]

I think I have the same problem, but how did you restart redis? When I try "sudo /etc/init.d/redis_6379 restart", I get "Stopping ... (error) NOAUTH Authentication required."

[Kohanz]

Nevermind, I found the PID and sudo kill'd the process.

[Thanh]

@Kohanz you can run sudo service redis-server restart to restart redis

[Kohanz]

@KienThanh thanks but that didn't work for me (perhaps it was not installed as a service?)