Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-27032

Memcached: the listen setting "must" be open to all the necessary servers

    Details

      Description

      Following EZP-26972, the system is updated to the latest version of PHP 7 and memcached and, when the user is unable to login.

      A message similar to the one below can be seen in the log files:

      [Fri Feb 10 10:44:05.351933 2017] [:error] [pid 12447] [client 192.168.2.109:45252] PHP Warning: SessionHandler::read(): Failed to write session lock: CONNECTION FAILURE in /var/www/html/ezplatform/app/cache/prod/classes.php on line 416, referer: http://ezdfs1.ezp/ez

      Such behavior happens because memcached is bind to the localhost address, preventing network accesses.

      To confirm it, check the /etc/memcached.conf file and confirm the excerpt below is present

      # Specify which IP address to listen on. The default is to listen on all IP addresses
      # This parameter is one of the only security measures that memcached has, so make sure
      # it's listening on a firewalled interface.
      -l 127.0.0.1

      For development environments, a simple tweak is to change the address to 0.0.0.0

      -l 0.0.0.0

      For production environments, a more secure approach should be take as explained in the man file:

      -l <addr>
      Listen on <addr>; default to INADDR_ANY. <addr> may be specified as host:port. If you don't specify a port number, the value you specified with -p or -U is used. You may specify multiple addresses separated by comma or by using -l multiple times.

      This is an important option to consider as there is no other way to secure the installation. Binding to an internal or firewalled network interface is suggested.

      IMPORTANT
      That said, it's important to add a warning in the memcached configuration pages to remember the user that memcached must not be bind to the local address if clusters are in use, of the user logins will fail.

        Activity

        Eduardo Fernandes (Inactive) created issue -
        Eduardo Fernandes (Inactive) made changes -
        Field Original Value New Value
        Status Open [ 1 ] Confirmed [ 10037 ]
        Eduardo Fernandes (Inactive) made changes -
        Component/s Documentation [ 10793 ]
        Dominika Kurek made changes -
        Assignee Dominika Kurek [ dominika.kurek@ez.no ]
        Dominika Kurek made changes -
        Status Confirmed [ 10037 ] Backlog [ 10000 ]
        Dominika Kurek made changes -
        Status Backlog [ 10000 ] Documentation [ 10010 ]
        Dominika Kurek made changes -
        Status Documentation [ 10010 ] Documentation Review done [ 10011 ]
        Assignee Dominika Kurek [ dominika.kurek@ez.no ]
        Eduardo Fernandes (Inactive) made changes -
        Status Documentation Review done [ 10011 ] QA [ 10008 ]
        Eduardo Fernandes (Inactive) made changes -
        Status QA [ 10008 ] QA done [ 10007 ]
        Assignee Eduardo Fernandes [ eduardo.fernandes@ez.no ]
        Eduardo Fernandes (Inactive) made changes -
        Status QA done [ 10007 ] Closed [ 6 ]
        Resolution Fixed [ 1 ]
        Alex Schuster made changes -
        Workflow EZ* Development Workflow [ 102922 ] EZEE Development Workflow [ 126341 ]

          People

          • Assignee:
            Unassigned
            Reporter:
            Eduardo Fernandes (Inactive)
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: