teleport/docs/pages/database-access/guides/redis.mdx

---
title: Database Access with Redis
description: How to configure Teleport Database Access with Redis.
---

<Details
  title="Version warning"
  opened={true}
  scope={["oss", "enterprise"]}
  scopeOnly={true}
  min="9.0"
>
  Database access for Redis is available starting from Teleport `9.0`.
</Details>

If you want to configure Redis Cluster, please read [Database Access with Redis Cluster](redis-cluster.mdx).

This guide will help you to:

- Install and configure Teleport.
- Configure mutual TLS authentication between Teleport and Redis.
- Connect to Redis through Teleport.

<ScopedBlock scope={["oss", "enterprise"]}>
![Teleport Database Access Redis Self-Hosted](../../../img/database-access/guides/redis_selfhosted.png)
</ScopedBlock>
<ScopedBlock scope={["cloud"]}>
![Teleport Database Access Redis Cloud](../../../img/database-access/guides/redis_cloud.png)
</ScopedBlock>

## Prerequisites

(!docs/pages/includes/edition-prereqs-tabs.mdx!)

- Redis version `6.0` or newer.

- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.

- A host where you will run the Teleport Database Service. Teleport version 9.0
  or newer must be installed.

  See [Installation](../../installation.mdx) for details.

<Admonition type="note" title="Note">
  Redis `7.0` and RESP3 (REdis Serialization Protocol) are currently not supported.
</Admonition>

(!docs/pages/includes/tctl.mdx!)

## Step 1/5. Set up the Teleport Database Service

(!docs/pages/includes/database-access/token.mdx!)

Install Teleport on the host where you will run the Teleport Database Service:

(!docs/pages/includes/install-linux.mdx!)

<ScopedBlock scope={["oss", "enterprise"]}>

Start the Teleport Database Service, pointing the `--auth-server` flag to the
address of your Teleport Proxy Service:

```code
$ teleport db start \
  --token=/tmp/token \
  --auth-server=teleport.example.com:3080 \
  --name=example-redis \
  --protocol=redis \
  --uri=rediss://redis.example.com:6379 \
  --labels=env=dev
```

<Admonition type="note">

The `--auth-server` flag must point to the Teleport cluster's Proxy Service
endpoint because the Database Service always connects back to the cluster over a
reverse tunnel.

</Admonition>

</ScopedBlock>
<ScopedBlock scope={["cloud"]}>

Start the Teleport Database Service, pointing the `--auth-server` flag to the
address of your Teleport Cloud tenant:

```code
$ teleport db start \
  --token=/tmp/token \
  --auth-server=mytenant.teleport.sh:443 \
  --name=example-redis \
  --protocol=redis \
  --uri=rediss://redis.example.com:6379 \
  --labels=env=dev
```

</ScopedBlock>

<Admonition type="tip">
  You can start the Database Service using a configuration file instead of CLI flags.
  See the [YAML reference](../reference/configuration.mdx) for details.
</Admonition>

## Step 2/5. Create a Teleport user

(!docs/pages/includes/database-access/create-user.mdx!)

## Step 3/5. Create Redis users

(!docs/pages/includes/database-access/redis-create-users.mdx!)

## Step 4/5. Set up mutual TLS

(!docs/pages/includes/database-access/tctl-auth-sign.mdx!)

We will show you how to use `tctl auth sign` below.

When connecting to standalone Redis, sign the certificate for the hostname over
which Teleport will be connecting to it.

For example, if your Redis server is accessible at `redis.example.com`,
run:

```code
$ tctl auth sign --format=redis --host=redis.example.com --out=server --ttl=2190h
```

(!docs/pages/includes/database-access/ttl-note.mdx!)

The command will create three files:
- `server.cas` with Teleport's certificate authority
- `server.key` with a generated private key
- `server.crt` with a generated user certificate

You will need these files to enable mutual TLS on your Redis server.

(!docs/pages/includes/database-access/rotation-note.mdx!)

Use the generated secrets to enable mutual TLS in your `redis.conf` configuration
file and restart the database:

```ini
tls-port 6379
port 0
aclfile /path/to/users.acl
tls-ca-cert-file /path/to/server.cas
tls-cert-file /path/to/server.crt
tls-key-file /path/to/server.key
tls-protocols "TLSv1.2 TLSv1.3"
```

Once mutual TLS has been enabled, you will no longer be able to connect to
the cluster without providing a valid client certificate. You can use the
`tls-auth-clients optional` setting to allow connections
from clients that do not present a certificate.

See [TLS Support](https://redis.io/topics/encryption)
in the Redis documentation for more details.

## Step 5/5. Connect

(!docs/pages/includes/database-access/redis-connect.mdx!)

### Supported Redis commands

Redis in standalone mode doesn't support the commands below. If one of the listed commands is called Teleport
returns the <nobr>`ERR Teleport: not supported by Teleport`</nobr> error.

- `HELLO`
- `PUNSUBSCRIBE`
- `SSUBSCRIBE`
- `SUNSUBSCRIBE`

## Next steps

(!docs/pages/includes/database-access/guides-next-steps.mdx!)