Redis password error from one server but not from another - redis

Question

I'm trying to connect to a redis server from two different servers, call them server1 and server2
From server1 I cannot login, using the right or the wrong password I always get:
user#server1:~$ redis-cli -h my-redis-server.com
my-redis-server.com:6379> auth rightpassword
(error) WRONGPASS invalid username-password pair
From server2 I can login
user#server2:~$ redis-cli -h my-redis-server.com
my-redis-server.com:6379> auth rightpassword
OK
But the funny thing is the error when trying to login from server2 with the wrong password is different
user#server2:~$ redis-cli -h my-redis-server.com
my-redis-server.com:6379> auth wrongpassword
(error) ERR invalid password
Using the monitor command on the redis server the login attempts from server1 are not printed while the login attempts (successful or not) from server2 are printed.
It seems the firewall is not blocking connections from server1 and also the redis server is configured to accept connections from server1 "bind 0.0.0.0". I mean, it actually looks like connections are accepted from server1 but somehow redis is refusing to run commands from server1 :-/ From what I've seen, redis doesn't have a way of blocking access per IP other than the "bind" config, and even that should return a connection refused rather than a wrong password error. I also think if the firewall was blocking, I should get a connection refused.
Geez, I must be missing something. Does anybody has a clue about what could be going on here?
PS: wonder why even redis has two different wrong password errors :-|

Answer 1

With Redis version 6+, they have added the ability of Access Control Lists (ACLs) for allowing users access to specific commands (read, write, key-constrained, etc.) based on the permissions of the user.
This may be why this error is being displayed:
(error) WRONGPASS invalid username-password pair
The AUTH command is slightly different for Redis version 6+:
AUTH command documentation: https://redis.io/commands/auth/
AUTH [username] password
ACL Documentation:
https://redis.io/docs/manual/security/acl/
If both of the Redis server versions are the same (i.e. 6+) then I would guess that server #2 has the default user enabled, which is why the AUTH command works. The concept of the default user is Redis' way of maintaining backwards compatibility with versions previous to 6. The current way that server #2 is operating is the default configuration for Redis. From what you mentioned in your original post, it seems like server #1 has the default user disabled and instead another user was created, possibly with different permissions.
For server #1, you may be able to run:
whoami
This should return the username that could be used for this command:
AUTH [username] password
It may also be helpful to run:
ACL LIST
to view the current users and their permissions