Common attacks and weaknesses
- Unauthenticated access to all data.
- CONFIG SET abused to write SSH keys or cron jobs and take over the server.
- Cryptominer campaigns targeting exposed instances.
Port 6379: Redis
Redis in-memory data store. Historically shipped without authentication.
6379
How Redis works
Databases & cachesThe application reads and writes values kept in memory: answers come back in well under a millisecond. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP
- Exposure risk
- 9/10 critical if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Databases & caches
Is port 6379 dangerous?
How to secure it
- Bind to localhost and keep protected-mode on.
- Enable ACLs or requirepass and TLS.
- Rename or disable dangerous commands (CONFIG, MODULE).
IANA registry entries for port 6379
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| redis | 6379 | TCP | An advanced key-value cache and store | - | 2015-04-23 |
| - | 6379 | - | Reserved | - | - |
// source: IANA service name and port number registry
Which program uses port 6379, and is it reachable?
Linux
sudo ss -ltnup 'sport = :6379' # process listening on 6379
sudo lsof -nP -i :6379macOS
sudo lsof -nP -i :6379
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 6379 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 6379 netstat -ano | findstr :6379
From another machine
nmap -p 6379 -sV <host> nc -zv <host> 6379
Block it in the firewall
sudo ufw deny 6379/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 6379" -Direction Inbound -LocalPort 6379 -Protocol TCP -Action Block # Windows
What is port 6379 used for?
Redis in-memory data store. Historically shipped without authentication.
Is port 6379 TCP or UDP?
Port 6379 is registered for TCP.
Is it safe to open port 6379?
It is rated 9/10 (critical) when exposed to the Internet. Unauthenticated access to all data. Bind to localhost and keep protected-mode on.
How do I check if port 6379 is open?
On Linux run "ss -ltnup 'sport = :6379'", on macOS "lsof -nP -i :6379", and on Windows "netstat -ano | findstr :6379" to see the local process. From another machine, "nmap -p 6379 <host>" shows whether it is reachable.
Other databases & caches ports
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :27017 MongoDB tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk