Chillbox / Security checks / Redis on 0.0.0.0

Redis is listening on `0.0.0.0`. Now what?

Something told you port 6379 is bound to every interface. That is a fact about a socket, and on its own it is not a verdict. Whether it is an open database depends on two settings, and you can read both in about ten seconds.

Most pages about this skip straight to the scary version. Here is the boring, accurate one.

Get Chillbox · free to tryFree to download. 7 days to try it, then $7.99 once. No subscription, no account, no cloud.

Chillbox listing services that answer on every interface, including Redis on port 6379 — **Chillbox names the service, not just the port.** It reports what is listening where, and stops there, because that is what it measured.

What 0.0.0.0 actually says

It answers on every network the machine is on

0.0.0.0 is not an address, it is all of them. A service bound there replies on your LAN, on the VPN you forgot was up, on the Wi-Fi at the office, and on the public interface if the machine has one. Bound to 127.0.0.1, it replies only to the machine itself.

So the question is never "is 0.0.0.0 bad". It is: which networks is this machine on, and who else is on them? On a laptop that is you. On a VPS it is the internet.

$ sudo ss -tlnp | grep 6379
LISTEN 0 511  0.0.0.0:6379  0.0.0.0:*  users:(("redis-server",pid=612,fd=6))

The part most posts get wrong

Protected mode may already be refusing them

Redis has shipped protected-mode yes since 3.2. While it is on, Redis refuses connections from anywhere but loopback — but only when no bind is configured and no password is set. It is a guard for the default config, not a firewall.

Which means the two common situations look identical from the outside and are not the same at all:

No `bind` line, no password

protected-mode is doing its job

Redis listens on every interface but answers only the machine itself. A remote client gets a refusal explaining protected mode. Untidy, not open.

`bind 0.0.0.0` written in the config

protected-mode no longer applies

Configuring bind switches the guard off by design. With no requirepass, anyone who can reach port 6379 gets a full, unauthenticated Redis.

The second one is not an exotic misconfiguration. It is what you get by following almost any "make Redis reachable from another container" tutorial to the letter and stopping one step early.

The answer

Two commands tell you which one you have

Run this: redis-cli CONFIG GET bind
redis-cli CONFIG GET requirepass

If you are not sure the guard is up, stop guessing and ask from another machine on the same network. A refusal that names protected mode is a clear answer; a prompt is a clearer one.

Fixing it

In the order that actually helps

If nothing outside the machine needs Redis, bind it back to loopback. This is the whole fix and it costs nothing:

# /etc/redis/redis.conf
bind 127.0.0.1 -::1

If something does need it, set a password with requirepass and keep the port off the open network anyway — a firewall rule, or a Docker publish that names an interface instead of all of them. A password on a port the internet can reach is one hard problem; a password on a port only your LAN can reach is a much smaller one.

# publish to one interface, not to every one
# this:   docker run -p 127.0.0.1:6379:6379 redis
# not:    docker run -p 6379:6379 redis

And one trap worth naming: a ufw rule does not filter a published Docker port. Docker writes its own iptables rules ahead of ufw's chain, so a container published to 0.0.0.0 stays reachable while ufw status reports the port as denied. Publish to the interface you mean instead of firewalling afterwards.

Why this page exists

The app reports the socket, not a verdict it did not earn

Chillbox lists what answers on every interface and names the service running there. It does not promise you are owned, because from an SSH session it measured a listening socket, and a listening socket is not the same claim as an open database.

Overstating that would be the same mistake as understating it. The app's one rule is that it says what it checked, and says so when it could not check.

What it reads: ss listeners, matched against the services it recognised
If ss is missing: Says not evaluated. Never a pass
Also tells you: When a new port opens that was not there last time
Costs: Free to try, then $7.99 once

See every port your servers answer on

Add a server with the SSH login you already use. Chillbox reports what it found, and what it could not.