Hello
Memcached daemon supports authentication via SASL.
http://code.google.com/p/memcached/wiki/SASLAuthProtocol
This can be used to effectively limit which users on a system can access memcached, as well as to strengthen it's security (not cool if user A can read data from user B...) -- particularly useful on a shared hosting environment or on a open system.
Unfortunately MS doesn't support this feature yet.
How to enable SASL in Memcached daemon:
http://code.google.com/p/memcached/wiki/SASLHowto
- add the flag "-S" in /etc/memcached.conf (Debian);
- create an user for the login being used for memcached under php: "sudo saslpasswd2 -a memcached -c someuser" and type a password;
Enable SASL in Memcached PECL extension:4
http://php.net/manual/en/book.memcached.php
- add the option "memcached.use_sasl = 1" in /etc/php5/mods-available/memcached.ini or on your site's php.ini;
Note: Memcache PECL extension does not seem to support SASL.
Test with:
<?php
$m = new Memcached();
$m->setOption(Memcached::OPT_BINARY_PROTOCOL, true);
$m->setSaslAuthData("someuser", "password");
?>
SASL auth is controlled via setSaslAuthData.
I figure the complexity required to implement this in MS is not too high.
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | memcache_storage_sasl_auth_support-2063811-8.patch | 3.02 KB | spleshka |
| #7 | memcache_storage_sasl_auth_support-2063811-7.patch | 3.02 KB | spleshka |
Comments
Comment #1
spleshkaGood catch, thanks! Going to provide a patch soon.
Comment #2
lpalgarvio commentedforgot to mention that binary protocol is a requirement.
documentation perhaps could mention that =P
Comment #3
spleshkaMay be we should do this way: if sasl auth is enabled, then binary protocol gets automatically enabled?
Comment #4
spleshkaI mean in MS configuration, of cource.
Comment #5
lpalgarvio commentedthat looks good
Comment #6
spleshkaOkey, great. Then we'll do like this.
Comment #7
spleshkaDoes this patch seems correct for you?
Comment #8
spleshkaOh, small typo in word "password".
Comment #9
spleshkaI've tested this - works perfectly. Thanks again, commited and pushed.
Comment #11
lpalgarvio commentedHello
I haven't been able to find time to test this.
May you also give credit to me for this commit? Thanks