Protecting memcached data from unauthorized access

An attacker with access to the memcached port (port 11211 by default) on the DNCA, can read memcached operational data, read TLS session state for any active sessions, and cause the denial of service by writing specially crafted data (or just clearing the cache).

About this task

DNCA uses memcached and libmemcached to manage a shared cache of shadowed TLS session state, so that it can decrypt a resumed TLS session.

The cache is used whenever TLS decryption is enabled, even if there is only one DNCA.

DNCA uses memcached with authentication disabled. The memcached data is not encrypted by default, but a customer can configure the system to encrypt the data (although with an AES key, that is easy to determine).

To protect memcached data from unauthorized access, perform the following steps:

Procedure

  1. Create a user name and password by running the following script: 
    cd /usr/local/dncauser/sbin
   ./sasl-username-password.sh
  2. Verify the username has been added to the SASL database by running the following command: 
    cd /usr/local/dncauser/sbin
     ./sasldblistusers2 -f $installed_path/sasldb
  3. Update the DNCA configuration by running the following command:
    Note: If you are running in the memcached pool, then the username and password must be same across the pool. 
    cd /usr/local/dncauser/sbin/etc/
    1. For a new DNCA installation:
      Locate the Pool Section of xml and edit the following lines:
      
vim dcx-conf.xml
    <SaslAuth>true</SaslAuth>
    <MemcachedUser>username</MemcachedUser>
    <MemcachedPassword>userpassword</MemcachedPassword>
    2. For an upgrade of your DNCA installation:
      Locate the Pool section of xml and add the following lines: (refer dcx-conf-defaults.xml):
      
vim dcx-conf.xml
    <SaslAuth>true</SaslAuth>
    <MemcachedUser>username</MemcachedUser>
    <MemcachedPassword>userpassword</MemcachedPassword>