Skip to content

Commit 377816a

Browse files
danielsenlandlinesadamoverajddocs
authored
[NEW] Installing and Securing Memcached on Debian (#3966)
* Initial draft. * Initial draft. * Formatting fixes. * Tech Edit 1 * Blueberry Fixes * More Blueberry Fixes * copy edits --------- Co-authored-by: danielsen <[email protected]> Co-authored-by: Adam Overa <[email protected]> Co-authored-by: John Dutton <[email protected]>
1 parent 8271f97 commit 377816a

File tree

1 file changed

+321
-0
lines changed
  • docs/guides/databases/memcached/install-and-secure-memcached-on-debian-11-and-ubuntu-2204

1 file changed

+321
-0
lines changed

‎docs/guides/databases/memcached/install-and-secure-memcached-on-debian-11-and-ubuntu-2204/index.md‎

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,321 @@
1+
---
2+
slug: install-and-secure-memcached-on-debian-11-and-ubuntu-2204
3+
title: "Install and Secure Memcached on Debian 11 and Ubuntu 22.04"
4+
description: "Learn how to install and configure Memcached on Debian and Ubuntu, and then secure your installation using SASL authentication and firewall rules."
5+
authors: ["Dan Nielsen"]
6+
contributors: ["Dan Nielsen"]
7+
published: 2024-06-03
8+
keywords: ['memcached', 'debian', 'ubuntu', 'sasl', 'secure memcached']
9+
license: '[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0)'
10+
external_resources:
11+
- '[Memcached](https://www.memcached.org)'
12+
---
13+
14+
[*Memcached*](https://memcached.org/) is an in-memory key-value store for small chunks of arbitrary data. Memcached is often used to enhance web application performance and scalability by temporarily caching frequently accessed data and reducing direct requests to databases.
15+
16+
This guide walks through the installation steps for Memcached on Debian 11 and Ubuntu 22.04 LTS systems. Additionally, it goes over multiple solutions for securing your Memcached installation, including SASL authentication and adding firewall rules with UFW.
17+
18+
## Before You Begin
19+
20+
1. If you do not already have a virtual machine to use, create a Compute Instance with at least 4 GB of memory. See our [Getting Started with Linode](/docs/products/platform/get-started/) and [Creating a Compute Instance](/docs/products/compute/compute-instances/guides/create/) guides.
21+
22+
1. Follow our [Setting Up and Securing a Compute Instance](/docs/products/compute/compute-instances/guides/set-up-and-secure/) guide to update your system. You may also wish to set the timezone, configure your hostname, create a limited user account, and harden SSH access.
23+
24+
1. Follow our [How to Configure a Firewall with UFW](/docs/guides/configure-firewall-with-ufw/) guide to install UFW, allow SSH access, and enable the firewall.
25+
26+
{{< note >}}
27+
This guide is written for a non-root user. Commands that require elevated privileges are prefixed with `sudo`. If you’re not familiar with the `sudo` command, see the [Users and Groups](/docs/guides/linux-users-and-groups/) guide.
28+
{{< /note >}}
29+
30+
## Install Memcached
31+
32+
Memcached is available from the official Debian and Ubuntu repositories.
33+
34+
1. First, install Memcached:
35+
36+
```command
37+
sudo apt install memcached
38+
```
39+
40+
1. Next, install `libmemcached-tools`, a library that provides several tools for interacting with Memcached servers:
41+
42+
```command
43+
sudo apt install libmemcached-tools
44+
```
45+
46+
1. Verify that Memcached is installed and running:
47+
48+
```command
49+
sudo systemctl status memcached
50+
```
51+
52+
The expected output should resemble:
53+
54+
```output
55+
● memcached.service - memcached daemon
56+
Loaded: loaded (/lib/systemd/system/memcached.service; enabled; vendor preset: enabled)
57+
Active: active (running) since Thu 2024-06-06 11:29:42 EDT; 18s ago
58+
```
59+
60+
Press the <kbd>Q</kbd> to exit the status output and return to the terminal prompt.
61+
62+
1. Make sure that Memcached is listening on the default address:
63+
64+
```command
65+
sudo ss -plunt | grep memcached
66+
```
67+
68+
By default, there should only be one IPv4 localhost (`127.0.0.1`) entry for Memcached:
69+
70+
```output
71+
tcp LISTEN 0 1024 127.0.0.1:11211 0.0.0.0:* users:(("memcached",pid=1789,fd=26))
72+
```
73+
74+
1. Use the `memcstat` tool to check the status of Memcached on `127.0.0.1`:
75+
76+
```command
77+
memcstat --servers="127.0.0.1"
78+
```
79+
80+
```output
81+
Server: 127.0.0.1 (11211)
82+
pid: 1789
83+
uptime: 420
84+
time: 1717688200
85+
version: 1.6.9
86+
...
87+
```
88+
89+
## Securing the Installation
90+
91+
The following sections cover various solutions for securing a Memcached installation. These steps are not strictly necessary when Memcached listens locally. However, if Memcached is exposed over a network, all of these sections should be completed to protect it from unauthorized access and other potential security threats.
92+
93+
### Open External Access and Disable UDP
94+
95+
1. Using a text editor, open the `/etc/memcached.conf` file:
96+
97+
```command
98+
sudo nano /etc/memcached.conf
99+
```
100+
101+
The default Memcached network address on Debian and Ubuntu is the local address (`127.0.0.1`). To open Memcached over the network, add your Compute Instances's external IP address. Disabling UDP using `-U 0` in the configuration is also recommended when opening Memcached access.
102+
103+
Save your changes once you are done editing the configuration file.
104+
105+
```file {title="/etc/memcached.conf" lang="conf" linenostart="31" hl_lines="6-9"}
106+
...
107+
# Specify which IP address to listen on. The default is to listen on all IP addresses
108+
# This parameter is one of the only security measures that memcached has, so make sure
109+
# it's listening on a firewalled interface.
110+
-l 127.0.0.1
111+
-l {{< placeholder "IP_ADDRESS" >}}
112+
113+
# Disable UDP
114+
-U 0
115+
116+
# Limit the number of simultaneous incoming connections. The daemon default is 10>
117+
# -c 1024
118+
...
119+
```
120+
121+
1. Restart Memcached to apply the changes:
122+
123+
```command
124+
sudo systemctl restart memcached
125+
```
126+
127+
1. Verify the network changes with the `ss` and `grep` commands from before:
128+
129+
```command
130+
sudo ss -plunt | grep memcached
131+
```
132+
133+
There should now be a second Memcached entry for your compute instance's external IP address:
134+
135+
```output
136+
tcp LISTEN 0 1024 {{< placeholder "IP_ADDRESS" >}}:11211 0.0.0.0:* users:(("memcached",pid=2477,fd=27))
137+
tcp LISTEN 0 1024 127.0.0.1:11211 0.0.0.0:* users:(("memcached",pid=2477,fd=26))
138+
```
139+
140+
1. Use the `memcstat` tool to check the status of Memcached on your Compute Instance's external IP address. Replace {{< placeholder "IP_ADDRESS" >}} with your instance's IP:
141+
142+
```command
143+
memcstat --servers="{{< placeholder "IP_ADDRESS" >}}"
144+
```
145+
146+
```output
147+
Server: {{< placeholder "IP_ADDRESS" >}} (11211)
148+
pid: 2477
149+
uptime: 203
150+
time: 1717688684
151+
version: 1.6.9
152+
...
153+
```
154+
155+
### Add Firewall Rules
156+
157+
The below steps use `ufw` to manage firewall rules.
158+
159+
1. Add a single firewall rule to allow limited access to port `11211` from a remote machine. Replace {{< placeholder "CLIENT_IP_ADDRESS" >}} with the IP address of the remote machine you want to access the Memcached server from:
160+
161+
```command
162+
sudo ufw allow proto tcp from {{< placeholder "CLIENT_IP_ADDRESS" >}} to any port 11211
163+
```
164+
165+
```output
166+
Rule added
167+
```
168+
169+
1. Verify that the rule has been added to UFW:
170+
171+
```command
172+
sudo ufw status
173+
```
174+
175+
```output
176+
Status: active
177+
178+
To Action From
179+
-- ------ ----
180+
22/tcp ALLOW Anywhere
181+
11211/tcp ALLOW {{< placeholder "CLIENT_IP_ADDRESS" >}}
182+
22/tcp (v6) ALLOW Anywhere (v6)
183+
```
184+
185+
1. From the remote client machine, run `memcstat` again on your Compute Instance's external {{< placeholder "IP_ADDRESS" >}} to confirm a connection:
186+
187+
```command
188+
memcstat --servers="{{< placeholder "IP_ADDRESS" >}}"
189+
```
190+
191+
```output
192+
Server: 172.233.162.226 (11211)
193+
pid: 2477
194+
uptime: 1102
195+
time: 1717689583
196+
version: 1.6.9
197+
```
198+
199+
{{< note >}}
200+
The remote client machine must also have Memcached and `libmemcached-tools` installed.
201+
{{< /note >}}
202+
203+
### Install and Configure SASL
204+
205+
Memcached doesn't provide internal authentication procedures. However, Simple Authentication and Security Layer (SASL) can be used to provide authentication to Memcached. SASL is a framework that de-couples authentication procedures from application protocols.
206+
207+
1. First, install SASL:
208+
209+
```command
210+
sudo apt install sasl2-bin
211+
```
212+
213+
1. Next, create the directory that the Memcached uses for SASL configuration:
214+
215+
```command
216+
sudo mkdir -p /etc/sasl2
217+
```
218+
219+
1. Now create a `memcached.conf` SASL configuration file in that directory:
220+
221+
```command
222+
sudo nano /etc/sasl2/memcached.conf
223+
```
224+
225+
Add the following content to the SASL configuration file, and save your changes:
226+
227+
```file {title="/etc/sasl2/memcached.conf" lang="conf"}
228+
mech_list: plain
229+
log_level: 5
230+
sasldb_path: /etc/sasl2/memcached-sasldb2
231+
```
232+
233+
### Add Authorized Users
234+
235+
1. Create a SASL database and user. Replace {{< placeholder "SASL_USERNAME" >}} with a username of your choice:
236+
237+
```command
238+
sudo saslpasswd2 -a memcached -c -f /etc/sasl2/memcached-sasldb2 {{< placeholder "SASL_USERNAME" >}}
239+
```
240+
241+
Enter a password of your choosing, and verify that password:
242+
243+
```output
244+
Password:
245+
Again (for verification):
246+
```
247+
248+
1. Give Memcached ownership of the database:
249+
250+
```command
251+
sudo chown memcache:memcache /etc/sasl2/memcached-sasldb2
252+
```
253+
254+
### Enable SASL
255+
256+
1. With a text editor, open the `/etc/memcached.conf` file:
257+
258+
```command
259+
sudo nano /etc/memcached.conf
260+
```
261+
262+
Enable SASL by adding the `-S` parameter to `/etc/memcached.conf`, and save your changes:
263+
264+
```file {title="/etc/memcached.conf" lang="conf" linenostart="31" hl_lines="11,12"}
265+
...
266+
# Specify which IP address to listen on. The default is to listen on all IP addresses
267+
# This parameter is one of the only security measures that memcached has, so make sure
268+
# it's listening on a firewalled interface.
269+
-l 127.0.0.1
270+
-l {{< placeholder "IP_ADDRESS" >}}
271+
272+
# Disable UDP
273+
-U 0
274+
275+
# Enable SASL authenication
276+
-S
277+
278+
# Limit the number of simultaneous incoming connections. The daemon default is 10>
279+
# -c 1024
280+
...
281+
```
282+
283+
1. Restart Memcached to apply the changes:
284+
285+
```command
286+
sudo systemctl restart memcached
287+
```
288+
289+
1. Check the Memcached status locally once again. Replace {{< placeholder "SASL_USERNAME" >}} and {{< placeholder "SASL_PASSWORD" >}} with your chosen username and password:
290+
291+
```command
292+
sudo memcstat --servers="127.0.0.1" --username="{{< placeholder "SASL_USERNAME" >}}" --password="{{< placeholder "SASL_PASSWORD" >}}"
293+
```
294+
295+
The output should look similar to this:
296+
297+
```output
298+
Server: 127.0.0.1 (11211)
299+
pid: 2956
300+
uptime: 198
301+
time: 1717690598
302+
version: 1.6.9
303+
...
304+
```
305+
306+
1. Repeat the process from the remote machine, using your Compute Instance's external IP address instead of `127.0.0.1`:
307+
308+
```command
309+
sudo memcstat --servers="{{< placeholder "IP_ADDRESS" >}}" --username="{{< placeholder "SASL_USERNAME" >}}" --password="{{< placeholder "SASL_PASSWORD" >}}"
310+
```
311+
312+
The output should be the same as above:
313+
314+
```output
315+
Server: 172.233.162.226 (11211)
316+
pid: 2956
317+
uptime: 271
318+
time: 1717690671
319+
version: 1.6.9
320+
...
321+
```

0 commit comments

Comments
 (0)