Zimbra Memecache attacked

Received a colleague to notify the host cannot log in

and network colleagues to see after the increase in traffic, due to switch speed limit 100m, resulting in abnormal service, alarm constantly.

Temporarily release the speed limit after the discovery of Zimbra server traffic is too high 1G,

Log in to the host and found to be memcache port 11211 generated traffic

After discovering that the port listens for all IP, after querying the data, we can configure the "zimbramemcachedbindaddress" parameter to bind the listening IP, but zimbra the whole process is not familiar, or the script bar ...

Will/opt/zimbra/bin/zmmemcachedctl

In the

/opt/zimbra/common/bin/${servicename}-d-p ${pidfile}-P ${port:-11211} modified to/opt/zimbra/common/bin/${servicename}-D- P ${pidfile}-l 127.0.0.1-p ${port:-11211} Save

Restart Zimbra

Zmcontrol restart

Okay, the attack's gone.

After the Zimbra has been strengthened, all internal communication ports all listen to this machine, the port situation see appendix

Reference article:

Processing method:

SECURITY problem:open Memcached in Zimbra 8.6.0_ga_1153

https://forums.zimbra.org/viewtopic.php?t=56493&start=10

Port

Default Ports used by Zimbra

Https://wiki.zimbra.com/wiki/Ports

Close useless port write another article

Zimbra Memecache attacked