Memcache prevents illegal read of data security Configuration

Memcache server side is directly through the client directly after the operation, without any verification process, so if the server is directly exposed to the Internet is more dangerous, light data leakage by other unrelated personnel to view, heavy server was invaded, because the Mecache is run with root permissions, Besides, there may be some unknown bugs or buffer overflows, which are unknown, so the danger is predictable. To be on the safe side, I make two suggestions that can be a little bit of protection against hacking or data leaks.

1, intranet access or local access:

It is best to access the two servers in the intranet form, typically between the Web server and the Memcache server. Universal servers are two network cards, a point to the Internet, a point to the intranet, then let the Web server through the intranet network card to access the Memcache server, we memcache the server on the start of the monitoring intranet IP address and port, Access between the intranet can effectively prevent other illegal access.

The code is as follows	Copy Code
# memcached-d-M 1024-u root-l 192.168.0.200-p 11211-c 1024-p/tmp/memcached.pid Or: # memcached-d-M 1024-u root-l 127.0.0.1-p 11211-c 1024-p/tmp/memcached.pid

Memcache server-side setup listens to 11211 ports of 192.168.0.200 or local IP via intranet, consumes 1024MB of RAM, and allows maximum 1024 concurrent connections

2, set the firewall

Firewall is a simple and effective way, if it is two servers are hanging in the net, and need to access memcache through the extranet IP, then you can consider using a firewall or agent program to filter illegal access.

In general, we can use Iptables or FreeBSD under Linux to specify some rules to prevent illegal access, such as we can set up only our web server to access our Memcache server, while blocking other access.

The code is as follows	Copy Code
# iptables-f # iptables-p INPUT DROP # iptables-a input-p tcp-s 192.168.0.2--dport 11211-j ACCEPT # iptables-a input-p udp-s 192.168.0.2--dport 11211-j ACCEPT

The iptables rule above is to allow only 192.168.0.2 this Web server access to the Memcache server, can effectively prevent some illegal access, the corresponding can also add some other rules to enhance security, this can be done according to their own needs.

Of course, you can also directly reject the external connection 11211 port is also possible.