Hi mo23,
I've opened a Bug and you can add yourself to keep posted, and also vote for it - https://bugzilla.zimbra.com/show_bug.cgi?id=97404
Best regards
SECURITY PROBLEM: Open Memcached in Zimbra 8.6.0_GA_1153
- jorgedlcruz
- Zimbra Alumni
- Posts: 2782
- Joined: Thu May 22, 2014 4:47 pm
SECURITY PROBLEM: Open Memcached in Zimbra 8.6.0_GA_1153
The Ports wiki page is a good start but IMHO that information should be in the Admin Guide (probably in an appendix) with an exact documentation of which Zimbra service/package requires access to which other package and which port. Also, the options to change those ports should be included.
For example in this case:
from
to
port
default
zimbra-proxy
zimbra-memcached
zimbraMemcachedPort
11211
zimbra-store
zimbra-memcached
zimbraMemcachedPort
11211
(Surprised about the latter one? I was so as well in bug 90012.)
For example in this case:
from
to
port
default
zimbra-proxy
zimbra-memcached
zimbraMemcachedPort
11211
zimbra-store
zimbra-memcached
zimbraMemcachedPort
11211
(Surprised about the latter one? I was so as well in bug 90012.)
SECURITY PROBLEM: Open Memcached in Zimbra 8.6.0_GA_1153
Solution :
nano "/opt/zimbra/bin/zmmemcachedctl"
search line ( line 70 ) : /opt/zimbra/${servicename}/bin/${servicename} -d -P ${pidfile}
and changed to /opt/zimbra/${servicename}/bin/${servicename} -d -l 127.0.0.1 -P ${pidfile}
Result :
lsof -i -n -P | grep mem
memcached 7976 zimbra 26u IPv4 60941 0t0 TCP 127.0.0.1:11211 (LISTEN)
memcached 7976 zimbra 27u IPv4 60942 0t0 UDP 127.0.0.1:11211
nano "/opt/zimbra/bin/zmmemcachedctl"
search line ( line 70 ) : /opt/zimbra/${servicename}/bin/${servicename} -d -P ${pidfile}
and changed to /opt/zimbra/${servicename}/bin/${servicename} -d -l 127.0.0.1 -P ${pidfile}
Result :
lsof -i -n -P | grep mem
memcached 7976 zimbra 26u IPv4 60941 0t0 TCP 127.0.0.1:11211 (LISTEN)
memcached 7976 zimbra 27u IPv4 60942 0t0 UDP 127.0.0.1:11211
- tonster
- Zimbra Employee
- Posts: 313
- Joined: Fri Feb 21, 2014 10:14 am
- Location: Ypsilanti, MI
- ZCS/ZD Version: Release 8.7.0_GA_1659.RHEL6_64_2016
SECURITY PROBLEM: Open Memcached in Zimbra 8.6.0_GA_1153
This is not a proper solution. The proper solution is to maintain a proper firewall, as with many other ports that zimbra uses that shouldn't generally be open publicly, like lmtp and ldap.
-
- Posts: 1
- Joined: Tue Nov 14, 2017 1:23 am
Re: SECURITY PROBLEM: Open Memcached in Zimbra 8.6.0_GA_1153
I came across this today, and although I agree that firewalling is prudent, I also disagree that ports should be bound to all IPs by default on the assumption that a firewall will a) be in place and b) be configured to block this traffic. In my view, binding to all IPs should only occur when there is a specific need for it (i.e. multi-server).
Here's what might appear to be a better way to do this, for anyone else searching as I was today:
Make the changes:
Verify:
Restart Zimbra:
You can check that memcached is only running on 127.0.0.1:
Then run (once Zimbra has been running a short while):
You should have a non-zero value for total_items.
Warm regards,
Craig
Here's what might appear to be a better way to do this, for anyone else searching as I was today:
Code: Select all
su - zimbra
Code: Select all
/opt/zimbra/bin/zmprov ms `zmhostname` zimbraMemcachedBindAddress 127.0.0.1
/opt/zimbra/bin/zmprov ms `zmhostname` zimbraMemcachedClientServerList 127.0.0.1
Code: Select all
/opt/zimbra/bin/zmprov -l gs `zmhostname` zimbraMemcachedBindAddress
/opt/zimbra/bin/zmprov -l gs `zmhostname` zimbraMemcachedClientServerList
Code: Select all
zmcontrol restart
Now, if you want to verify that objects are being stored, then as root:$ lsof -i tcp:11211
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
memcached 12630 zimbra 26u IPv4 3443249076 0t0 TCP localhost:11211 (LISTEN)
Code: Select all
wget -O /usr/bin/memcached-tool https://raw.githubusercontent.com/memcached/memcached/master/scripts/memcached-tool
chmod +x /usr/bin/memcached-tool
Code: Select all
memcached-tool 127.0.0.1:11211 stats | grep total_items
Warm regards,
Craig