Memcache security configuration

Memcached-d-m 100-u root-l x.x.x.x-p 11211-c 512-P / tmp/memcached.pid

Parameter description:

The-d option is to start a daemon

-m is the amount of memory allocated to Memcache in MB, and this is 100MB.

-u is the user running Memcache. This is root.

-l is the IP address of the listening server. I specify the IP address x.x.x.x of the server here.

-p is the port on which Memcache snooping is set. I have set 11211 here, preferably a port above 1024.

The-c option is the maximum number of concurrent connections running. The default is 1024. I set it here according to the load of your server.

-P is the pid file that is set to save Memcache. Here I save it in / tmp/memcached.pid

Management tools:

PhpMemcachedAdmin graphical interface, operating memcache, similar to phpmyadmin

Safety problem

1. The Memcache server operates directly after connecting directly through the client, without any verification process. There is no verification process, so it is dangerous if the server is directly exposed to the Internet. if the data leak is checked by other unrelated personnel, the server will be compromised.

2. Mecache runs with root permissions, and there may be some unknown bug or buffer overflow conditions, which are unknown to us, so the danger is foreseeable.

Security configuration

1. Configure for private network access

# memcached-d-m 1024-u root-l 192.168.0.200-p 11211-c 1024-P / tmp/memcached.pid

two。 Set firewall limit port # iptables-F

# iptables-P INPUT DROP

# iptables-An INPUT-p tcp-s 192.168.0.2-dport 11211-j ACCEPT

# iptables-An INPUT-p udp-s 192.168.0.2-dport 11211-j ACCEPT

The iptables rule is to allow only 192.168.0.2 this Web server to access the Memcache server, which can effectively prevent some illegal access.

Reference: http://blog.csdn.net/shewey/article/details/51344998