Memory object caching systems like Memcached can optimize backend database performance by temporarily storing information in memory, retaining frequently or recently requested records. In this way, they reduce the number of direct requests to your databases.<\/p>\n
Because systems like Memcached can contribute to denial of service attacks if improperly configured, it is important to secure your Memcached servers. In this guide, we will cover how to protect your Memcached server by binding your installation to a local or private network interface and creating an authorized user for your Memcached instance.<\/p>\n
If you don’t already have Memcached installed on your server, you can install it from the official CentOS repositories. First, make sure that your local package index is updated:<\/p>\n
sudo yum update<\/code><\/pre>\nNext, install the official package as follows:<\/p>\n
sudo yum install memcached<\/code><\/pre>\nWe can also install libmemcached<\/code>, a library that provides several tools to work with your Memcached server:<\/p>\nsudo yum install libmemcached<\/code><\/pre>\nMemcached should now be installed as a service on your server, along with tools that will allow you to test its connectivity. We can now move on to securing its configuration settings.<\/p>\n
Securing Memcached Configuration Settings<\/h2>\n
To ensure that our Memcached instance is listening on the local interface 127.0.0.1<\/code>, we will modify the OPTIONS<\/code> variable in the configuration file located at \/etc\/sysconfig\/memcached<\/code>. We will also disable the UDP listener. Both of these actions will protect our server from denial of service attacks.<\/p>\nYou can open \/etc\/sysconfig\/memcached<\/code> with nano<\/code>:<\/p>\nsudo nano \/etc\/sysconfig\/memcached<\/code><\/pre>\nLocate the OPTIONS<\/code> variable, which will initially look like this:<\/p>\n\/etc\/sysconfig\/memcached<\/div>\n. . .\r\nOPTIONS=\"\"\r\n<\/code><\/pre>\nBinding to our local network interface will restrict traffic to clients on the same machine. We will do this by adding -l 127.0.0.1<\/code> to our OPTIONS<\/code> variable. This may be too restrictive for certain environments, but it can make a good starting point as a security measure.<\/p>\nBecause UDP protocol is much more effective for denial of service attacks than TCP, we can also disable the UDP listener. To do this, we will add the -U 0<\/code> parameter to our OPTIONS<\/code> variable. The file in full should look like this:<\/p>\n\/etc\/sysconfig\/memcached<\/div>\n\r\nPORT=\"11211\"\r\nUSER=\"memcached\"\r\nMAXCONN=\"1024\"\r\nCACHESIZE=\"64\"\r\nOPTIONS=\"-l 127.0.0.1 -U 0<\/span>\" \r\n<\/code><\/pre>\nSave and close the file when you are done.<\/p>\n
Restart your Memcached service to apply your changes:<\/p>\n
sudo systemctl restart memcached<\/code><\/pre>\nVerify that Memcached is currently bound to the local interface and listening only for TCP connections by typing:<\/p>\n
sudo netstat -plunt<\/code><\/pre>\nYou should see the following output:<\/p>\n
<\/code>Output<\/p>\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address Foreign Address State PID\/Program name\r\n. . .\r\ntcp<\/span> 0 0 127.0.0.1<\/span>:11211 0.0.0.0:* LISTEN 2383\/memcached<\/span>\r\n. . .<\/code><\/pre>\nThis confirms that memcached<\/code> is bound to the 127.0.0.1<\/code> address using only TCP.<\/p>\nAdding Authorized Users<\/h2>\n
To add authenticated users to your Memcached service, it is possible to use Simple Authentication and Security Layer (SASL), a framework that de-couples authentication procedures from application protocols. We will enable SASL within our Memcached configuration file and then move on to adding a user with authentication credentials.<\/p>\n
Configuring SASL Support<\/h3>\n
We can first test the connectivity of our Memcached instance with the memstat<\/code> command. This will help us establish that SASL and user authentication are enabled after we make changes to our configuration files.<\/p>\nTo check that Memcached is up and running, type the following:<\/p>\n
memstat --servers=\"127.0.0.1\"<\/code><\/pre>\nYou should see output like the following:<\/p>\n
<\/code>Output<\/p>\nServer: 127.0.0.1 (11211)\r\n pid: 3831\r\n uptime: 9\r\n time: 1520028517\r\n version: 1.4.25\r\n . . .<\/code><\/pre>\nNow we can move on to enabling SASL. First, we can add the -S<\/code> parameter to our OPTIONS<\/code> variable in \/etc\/sysconfig\/memcached<\/code>, which will enable SASL. Open the file again:<\/p>\nsudo nano \/etc\/sysconfig\/memcached<\/code><\/pre>\nWe will add both the -S<\/code> and -vv<\/code> parameters to our OPTIONS<\/code> variable. The -vv<\/code> option will provide verbose output to \/var\/log\/memcached<\/code>, which will help us as we debug. Add these options to the OPTIONS<\/code> variable as follows:<\/p>\n\/etc\/sysconfig\/memcached<\/div>\n. . .\r\nOPTIONS=\"-l 127.0.0.1 -U 0 -S -vv<\/span>\" \r\n<\/code><\/pre>\nSave and close the file.<\/p>\n
Restart the Memcached service:<\/p>\n
sudo systemctl restart memcached<\/code><\/pre>\nNext, we can take a look at the logs to be sure that SASL support has been enabled:<\/p>\n
sudo journalctl -u memcached<\/code><\/pre>\nYou should see the following line, indicating that SASL support has been initialized:<\/p>\n
<\/code>Output<\/p>\n. . .\r\nMar 05 18:16:11 memcached-server memcached[3846]: Initialized SASL.\r\n. . .<\/code><\/pre>\nWe can check the connectivity again, but because SASL has been initialized, this command should fail without authentication:<\/p>\n
memstat --servers=\"127.0.0.1\"<\/code><\/pre>\nThis command should not produce output. We can type the following to check its status:<\/p>\n
echo $?<\/code><\/pre>\n$?<\/code> will always return the exit code of the last command that exited. Typically, anything besides 0<\/code> indicates process failure. In this case, we should see an exit status of 1<\/code>, which tells us that the memstat<\/code> command failed.<\/p>\nAdding an Authenticated User<\/h3>\n
Now we can download two packages that will allow us to work with the Cyrus SASL Library and its authentication mechanisms, including plugins that support PLAIN<\/em> authentication schemes. These packages, cyrus-sasl-devel<\/code> and cyrus-sasl-plain<\/code>, will allow us to create and authenticate our user. Install the packages by typing:<\/p>\nsudo yum install cyrus-sasl-devel cyrus-sasl-plain<\/code><\/pre>\nNext, we will create the directory and file that Memcached will check for its SASL configuration settings:<\/p>\n
sudo mkdir -p \/etc\/sasl2<\/code><\/pre>\nsudo nano \/etc\/sasl2\/memcached.conf <\/code><\/pre>\nAdd the following to the SASL configuration file:<\/p>\n
\/etc\/sasl2\/memcached.conf<\/div>\nmech_list: plain\r\nlog_level: 5\r\nsasldb_path: \/etc\/sasl2\/memcached-sasldb2\r\n<\/code><\/pre>\nIn addition to specifying our logging level, we will set mech_list<\/code> to plain<\/code>, which tells Memcached that it should use its own password file and verify a plaintext password. We will also specify the path to the user database file that we will create next. Save and close the file when you are finished.<\/p>\nNow we will create a SASL database with our user credentials. We will use the saslpasswd2<\/code> command to make a new entry for our user in our database using the -c<\/code> option. Our user will be sammy<\/strong> here, but you can replace this name with your own user. Using the -f<\/code> option, we will specify the path to our database, which will be the path we set in \/etc\/sasl2\/memcached.conf<\/code>:<\/p>\nsudo saslpasswd2 -a memcached -c -f \/etc\/sasl2\/memcached-sasldb2 sammy<\/span><\/code><\/pre>\nFinally, we want to give the memcached<\/code> user ownership over the SASL database:<\/p>\nsudo chown memcached:memcached \/etc\/sasl2\/memcached-sasldb2<\/code><\/pre>\nRestart the Memcached service:<\/p>\n
sudo systemctl restart memcached<\/code><\/pre>\nRunning memstat<\/code> again will confirm whether or not our authentication process worked. This time we will run it with our authentication credentials:<\/p>\nmemstat --servers=\"127.0.0.1\" --username=sammy<\/span> --password=your_password<\/span><\/code><\/pre>\nYou should see output like the following:<\/p>\n
<\/code>Output<\/p>\nServer: 127.0.0.1 (11211)\r\n pid: 3831\r\n uptime: 9\r\n time: 1520028517\r\n version: 1.4.25\r\n . . .<\/code><\/pre>\nOur Memcached service is now successfully running with SASL support and user authentication.<\/p>\n
Allowing Access Over the Private Network<\/h2>\n
We have covered how to configure Memcached to listen on the local interface, which can prevent denial of service attacks by protecting the Memcached interface from exposure to outside parties. There may be instances where you will need to allow access from other servers, however. In this case, you can adjust your configuration settings to bind Memcached to the private network interface.<\/p>\n
Limiting IP Access With Firewalls<\/h3>\n
Before you adjust your configuration settings, it is a good idea to set up firewall rules to limit the machines that can connect to your Memcached server. If you followed the prerequisites and installed FirewallD on your server and do not<\/strong> plan on connecting to Memcached from another host, then you do not need to adjust your firewall rules. Your standalone Memcached instance should be listening on 127.0.0.1<\/code>, thanks to the OPTIONS<\/code> variable we defined earlier, and there should therefore be no concerns about incoming traffic. If you plan to allow access to your Memcached server from other hosts, however, then you will need to make changes to your firewall settings using the firewall-cmd<\/code> command.<\/p>\nBegin by adding a dedicated Memcached zone to your firewalld<\/code> policy:<\/p>\nsudo firewall-cmd --permanent --new-zone=memcached\r\n<\/code><\/pre>\nThen, specify which port you would like to keep open. Memcached uses port 11211<\/code> by default:<\/p>\nsudo firewall-cmd --permanent --zone=memcached --add-port=11211\/tcp<\/code><\/pre>\nNext, specify the private IP addresses that should be allowed to access Memcached. For this, you will need to know your client server’s private IP address<\/strong>:<\/p>\nsudo firewall-cmd --permanent --zone=memcached --add-source=client_server_private_IP<\/span><\/code><\/pre>\nReload the firewall to ensure that the new rules take effect:<\/p>\n
sudo firewall-cmd --reload<\/code><\/pre>\nPackets from your client’s IP address should now be processed according to the rules in the dedicated Memcached zone. All other connections will be processed by the default public<\/code> zone.<\/p>\nWith these changes in place, we can move on to making the necessary configuration changes to our Memcached service, binding it to our server’s private networking interface.<\/p>\n
Binding Memcached to the Private Network Interface<\/h3>\n
The first step in binding to our server’s private networking interface will be modifying the OPTIONS<\/code> variable we set earlier.<\/p>\nWe can open \/etc\/sysconfig\/memcached<\/code> again by typing:<\/p>\nsudo nano \/etc\/sysconfig\/memcached<\/code><\/pre>\nInside, locate the OPTIONS<\/code> variable. We can now modify -l 127.0.0.1<\/code> to reflect our Memcached server’s private IP:<\/p>\n\/etc\/sysconfig\/memcached<\/div>\n. . .\r\nOPTIONS=\"-l memcached_servers_private_IP<\/span> -U 0 -S -vv\"\r\n<\/code><\/pre>\nSave and close the file when you are finished.<\/p>\n
Restart the Memcached service again:<\/p>\n
sudo systemctl restart memcached<\/code><\/pre>\nCheck your new settings with netstat<\/code> to confirm the change:<\/p>\nsudo netstat -plunt<\/code><\/code><\/pre>\nOutput<\/div>\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address Foreign Address State PID\/Program name\r\n. . .\r\ntcp<\/span> 0 0 memcached_servers_private_IP<\/span>:11211 0.0.0.0:* LISTEN 2383\/memcached<\/span><\/code><\/pre>\nTest connectivity from your external client to ensure that you can still reach the service. It is a good idea to also check access from a non-authorized client to ensure that your firewall rules are effective.<\/p>\n","protected":false},"excerpt":{"rendered":"
Introduction Memory object caching systems like Memcached can optimize backend database performance by temporarily storing information in memory, retaining frequently or recently requested records. In this way, they reduce the number of direct requests to your databases. Because systems like Memcached can contribute to denial of service attacks if improperly configured, it is important to … Continue reading Installing Memcached on CentOS<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":2464,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"title":"Installing Memcached on CentOS - HP Server","description":"Introduction Memory object caching systems like Memcached can optimize backend database performance by temporarily storing information in memory, retaining freq"},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2462","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts\/2462","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/comments?post=2462"}],"version-history":[{"count":0,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/posts\/2462\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/media\/2464"}],"wp:attachment":[{"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/media?parent=2462"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/categories?post=2462"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/easy-admin.ca\/index.php\/wp-json\/wp\/v2\/tags?post=2462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}