Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revision Both sides next revision
litespeed_wiki:lsmcd:new_sasl [2018/06/25 14:04]
Robert Perper [LSMCD Security Using SASL]
litespeed_wiki:lsmcd:new_sasl [2019/03/28 17:58]
Robert Perper [Configure for PHP]
Line 3: Line 3:
 SASL (Simple Application and Security Layer) is the method used to secure data in LSMCD and Memcached. There are various subtle differences in configuration between the two. This section describes the configuration you need to perform to allow LSMCD to operate in a SASL environment. SASL (Simple Application and Security Layer) is the method used to secure data in LSMCD and Memcached. There are various subtle differences in configuration between the two. This section describes the configuration you need to perform to allow LSMCD to operate in a SASL environment.
  
-Enabling SASL is database wide. Once SASL is enabled, all non-SASL databases will need to be regenerated. ​You will also need to regenerate your databases (the files stored in the ''​Cached.ShmDir''​ parameter of your node.conf file) if you wish to remove SASL.+Enabling SASL is database wide. Once SASL is enabled, all non-SASL databases will need to be regenerated. ​ This is only necessary if you ran LSMCD without SASL.  Regeneration is done by deleting ​the files stored in the ''​Cached.ShmDir''​ parameter of your node.conf file (defaults /​dev/​shm/​lsmcdand allow them to be recreated. You will also need to regenerate your databases ​if you wish to remove SASL.
  
-You can also secure data by user using SASL.  See https://​www.litespeedtech.com/​support/​wiki/​doku.php/​litespeed_wiki:​lsmcd:​sasl_secure_user_data for details.+You can also secure data by user using SASL.  See [[litespeed_wiki:​lsmcd:​sasl_secure_user_data|LSMCD Secure User Data Using SASL]] ​for details.
  
-As for memcached, if you enable SASL, text telnet commands will no longer work as there is no security mechanism in telnet. ​ The client program ''​memcapable''​ will fail all tests as it does not properly handle SASL.  If you wish to use this program to validate functionality,​ a customized version of the program is available in the distribution and can be built using instructions specified in the README.+As for Memcached, if you enable SASL, text telnet commands will no longer work as there is no security mechanism in telnet. ​ The client program ''​memcapable''​ will fail all tests as it does not properly handle SASL.  If you wish to use this program to validate functionality,​ a customized version of the program is available in the distribution and can be built using instructions specified in the README.
  
 ===== Configuring SASL ===== ===== Configuring SASL =====
  
 There are a number steps to configuring LSMCD to operate with SASL: There are a number steps to configuring LSMCD to operate with SASL:
-   * Enable SASL in your ''​lsmcd.conf''​ file.+   * Enable SASL in your ''​node.conf''​ file.
    * Create and configure a user database.    * Create and configure a user database.
    * Configure any additional settings needed for PHP.    * Configure any additional settings needed for PHP.
Line 23: Line 23:
   CACHED.USESASL=TRUE   CACHED.USESASL=TRUE
  
-Note that once SASL is enabled, ​access to all memcached ​functions are going to fail with an error written to the lsmcd log (defaults to /​tmp/​lsmcd.log).  ​Also when SASL is enabled, ASCII functions (telnet ​and other ASCII functions) ​will fail.+Note that once SASL is enabled, all failed accesses to Memcached ​functions are going to result in an error being written to the lsmcd log (defaults to ''​/​tmp/​lsmcd.log''​).  ​As mentioned above, ASCII and telnet commands are also going to fail as well. 
 + 
 +When you change this value, accesses to the existing LSMCD database ​will fail as the system will detect a mismatch between your prior SASL configuration and your current one You will need to delete your LSMCD data files: <​code>​rm -rf /​dev/​shm/​lsmcd</​code>​ 
 ==== Create and Configure a User Database ==== ==== Create and Configure a User Database ====
 A user database is required. The recommended method uses saslauthd, which is provided as part of Cyrus SASL to create a sasldb managed database. In prior versions there was only the MEMCACHED_SASL_PWDB environment variable method.  ​ A user database is required. The recommended method uses saslauthd, which is provided as part of Cyrus SASL to create a sasldb managed database. In prior versions there was only the MEMCACHED_SASL_PWDB environment variable method.  ​
Line 33: Line 36:
  
 To create a user named ''​user1''​ enter ''​saslpasswd2 user1''​. ​ You will be prompted for the password twice for that user.  That information will then need to be coded in your memcached program. ​ Details on the use of saslpasswd2 can be found in numerous places on the internet including [[https://​www.gsp.com/​cgi-bin/​man.cgi?​section=8&​topic=saslpasswd2|gsp.com]]. To create a user named ''​user1''​ enter ''​saslpasswd2 user1''​. ​ You will be prompted for the password twice for that user.  That information will then need to be coded in your memcached program. ​ Details on the use of saslpasswd2 can be found in numerous places on the internet including [[https://​www.gsp.com/​cgi-bin/​man.cgi?​section=8&​topic=saslpasswd2|gsp.com]].
 +
 +You can use either the simple user name or the realm qualified name visible in ''​sasldblistusers2''​ (the name with the ''​@hostname''​ appended to it).  Note that for user managed data it will use the name specified (which means the realm qualified and unqualified names will be separate).
  
 === Option #2: MEMCACHED_SASL_PWDB Environment Variable === === Option #2: MEMCACHED_SASL_PWDB Environment Variable ===
Line 62: Line 67:
 Some notes for all programming environments:​ Some notes for all programming environments:​
    * You must instantiate an instance of the Memcached object (Memcache no longer works).    * You must instantiate an instance of the Memcached object (Memcache no longer works).
-   * You must use the binary protocol.+   * You must use the binary protocol ​(must be the first Memcached method). 
 +   * You must turn off compression.
    * You must make the call to set the SASL authentication information (user/​password) before you add the server.    * You must make the call to set the SASL authentication information (user/​password) before you add the server.
    * Once you add the server successfully,​ you can perform all standard Memcached operations (get, put, etc.).    * Once you add the server successfully,​ you can perform all standard Memcached operations (get, put, etc.).
Line 69: Line 75:
 <?php <?php
 $mem_var = new Memcached();​ $mem_var = new Memcached();​
-$mem_var->​setSaslAuthData('​user',​ '​password'​);​ 
 $mem_var->​setOption(Memcached::​OPT_BINARY_PROTOCOL,​ true); $mem_var->​setOption(Memcached::​OPT_BINARY_PROTOCOL,​ true);
 $mem_var->​setOption(Memcached::​OPT_COMPRESSION,​ false); $mem_var->​setOption(Memcached::​OPT_COMPRESSION,​ false);
 +$mem_var->​setSaslAuthData('​user',​ '​password'​);​
 $mem_var->​addServer("​127.0.0.1",​ 11211); $mem_var->​addServer("​127.0.0.1",​ 11211);
 $response = $mem_var->​get("​SampleKey"​);​ $response = $mem_var->​get("​SampleKey"​);​
  • Admin
  • Last modified: 2019/11/27 14:32
  • by Robert Perper