Installing and Configuring Redis on RHEL 9 for Australian Sysadmins

Redis has become a staple of modern web stacks, and Linux administrators across Australia routinely pair it with Nginx, application servers, and analytics tools to cut latency for users in Sydney, Melbourne, Brisbane, and Perth. Running it on RHEL 9 brings predictable performance, long-term support, and tighter alignment with the ACSC Essential Eight maturity model that many federal agencies and ASX-listed companies reference.

This walkthrough takes a fresh RHEL 9 host from a clean subscription state through to a hardened, running Redis instance listening on the default port. The commands are reproducible, the configuration choices are explained, and a short checklist at the end summarises what to lock down before exposing the service to production traffic.

Preparing the RHEL 9 Host

Before any package touches the system, make sure the host is registered with Red Hat and patched. Run sudo subscription-manager register --auto-attach followed by sudo dnf update -y so the kernel and OpenSSL libraries are recent enough to satisfy the Australian Cyber Security Centre guidance on TLS and cryptographic hygiene. Australian organisations operating under the Privacy Act 1988 and the Notifiable Data Breaches scheme are expected to keep base operating system components current, and Redis inherits the security profile of the libraries it links against.

Enable the EPEL repository next, because the redis package lives there on RHEL 9 rather than in the core BaseOS channel. Use sudo dnf install epel-release -y and refresh metadata with sudo dnf makecache. Once EPEL is in place, dnf info redis should show a recent 7.x build ready for installation.

Installing Redis from EPEL

Install the server and the command-line client in a single transaction so dependency resolution covers jemalloc and openssl cleanly: sudo dnf install redis -y. After the install completes, confirm the binary version with redis-server --version and verify that the helper scripts landed under /usr/lib/systemd/system/redis.service and /etc/redis/redis.conf.

It is worth pausing here to think about network topology. Many Australian teams host Redis close to their application tier in regional data centres such as NextDC S1 in Sydney or Equinix ME1 in Melbourne, rather than across a long-haul link to overseas clouds. Keeping Redis on the same VLAN as the web tier, with Nginx reverse proxy upstream configuration already in place, reduces round-trip times for cache reads to single-digit milliseconds.

Tuning the redis.conf File

The default /etc/redis/redis.conf is intentionally conservative. Open it with sudo vim /etc/redis/redis.conf and adjust a handful of directives that matter for production use. Set bind 127.0.0.1 ::1 if Redis will only answer local application traffic, or bind to a private interface address when paired with a remote app host. Leave protected-mode yes enabled unless authentication is explicitly configured.

For memory management, set maxmemory to roughly 70 percent of available RAM and choose maxmemory-policy allkeys-lru for caching workloads. Persistence can be left at the RDB snapshot defaults, or switched to AOF append-only mode for stricter durability — Australian financial services often prefer AOF combined with off-host backups to satisfy APRA CPS 234 obligations on information asset resilience. Save the file and reload systemd awareness with sudo systemctl daemon-reload.

Hardening with Firewalld and SELinux

RHEL 9 enables SELinux by default, and Redis ships with a targeted policy module that can be activated without manual labelling. Confirm the boolean with getsebool redis_can_connect_any and adjust if application flows require it. Lock the listening port through firewall-cmd --permanent --add-port=6379/tcp followed by firewall-cmd --reload, then restrict the rule to a specific source subnet so the service is not exposed on the public internet — a misconfiguration that has historically led to cryptojacking incidents reported by the ACSC.

Authentication should always be enabled in production. Add requirepass to redis.conf with a long, randomly generated string stored in a secrets manager rather than a config file committed to version control. For deeper coverage, ACLs introduced in Redis 6 allow per-user command restrictions, which is useful when a single instance serves several internal teams in a Canberra-based government department.

Verifying the Running Service

Enable and start the daemon, then confirm it answers: sudo systemctl enable --now redis followed by redis-cli ping should return PONG. Run redis-cli info server to inspect uptime and version, and redis-cli info memory to see how the configured limits behave under load. A quick smoke test using redis-cli set test "hello" and redis-cli get test validates end-to-end read and write paths without needing a full application stack. Engineers preparing for platform roles in Sydney and Melbourne will recognise these checks from typical interview question sets used by Australian hiring panels.

Once the smoke test passes, capture the running configuration with redis-cli config get * and store it in your configuration management repository. From there, Ansible or Puppet can roll the same baseline across the remainder of your fleet, whether that is a handful of hosts in Adelaide or a multi-region deployment stretching from Perth to Townsville.

Production Hardening Checklist

• Bind Redis to a private interface and keep protected-mode yes enabled.
• Set maxmemory and maxmemory-policy deliberately, based on the workload mix.
• Enable requirepass and prefer ACL users over a single shared password.
• Allow only the 6379/tcp traffic through firewalld from a known source subnet.
• Activate RDB snapshots or AOF persistence, with backups copied off-host.
• Keep SELinux in enforcing mode and review booleans after each Redis upgrade.

The next concrete step is to open /etc/redis/redis.conf, pin down bind, maxmemory, and requirepass to values that match the application tier sitting behind your existing reverse proxy stack, and then reload the service with sudo systemctl restart redis.