SASL Memcached Now Available!

After the initial announcement by Dustin Sallings that the memcached server now has SASL support, (which is a feature in the newly released 1.4.3, announced just today) this past week has also resulted in a flurry of other developments, particularly in the client realm

A couple weeks ago Dustin added support in spymemcached (Java) and as of this week, Trond Norbye added support to libmemcached, now making it possible to take advantage of the memcached server’s support for your applications that use memcached! So now you probably want to know: “How can I use these new features?” This post will attempt to answer this question, as well as explain the mechanics of memcached and SASL authentication for your applications.

What is SASL?

SASL stands for Simple Authentication and Security Layer, which provides you a means of adding authentication support to connection-based protocols, such as the memcached client binary protocol in this case. It works via a function (API) call that is added to the client that provides a functionality for identifying and authenticating a given user. It also provides the means to implement protection throughout the entire connection. Once a user is identified and authenticated, the system provides a security layer between the client protocol and connection.

How is SASL Implemented for Memcached?

Until the binary protocol was added as well as the SASL implementation, memcached had no authentication layer whatsoever. Any client could connect to memcached and perform any operation at will. It was up to the memcached user (usually a web developer) to make sure that their network was locked down and that their application was designed securely. Then the binary protocol was added to memcached which made for a more efficient and compact client-server connection.

With SASL support, functions were added to the server that made it so a client connection was forced to authenticate before the complete connection could continue. This of course required a client that sent the authentication information. At first, only spymemcached client (java) was supported, but as already mentioned in the introduction, libmemcached is now also supported.

Basically, SASL uses storage for user credentials– it can be LDAP or a SQL database. In this example, the user credentials are stored in a database file on the server that memcached will be running. In order for a user to be able to connect to, memcached server won’t allow the user to connect unless they provide their credentials, and those credentials must match the stored user credentials. More information on the specifics of the implementation for memcached can be found here.

How Do I Install SASL With Memcached?

Well, the first thing you need to do is get the latest memcached server. One place you’ll find this is the memcached GitHub repository or memcached.org, explained in the next step. You also will need a few prerequisites on your server such as development libraries and as well as utilities such as saslpasswd. On Ubuntu, for instance, the packages are installed as:

Not to forget, the usual requirements for memcached: libevent Just search accordingly for your packages according to the operating system you are using.

How Do I Set Up SASL Memcached?

Now you will need to obtain SASL memcached. The code is now officially released from memcached.org wget http://memcached.googlecode.com/files/memcached-1.4.3.tar.gz tar xvzf memcached-1.4.3.tar.gz Or as always it is available via Github

Now compile and install:

Next, you will set up the database and memcached application configuration file. There are two ways to do this: system-wide or for a specific user.

System-Wide Database File:

For a system-wide set-up, you will need to set up a memcached.conf file to point to the database file which contains the user and password information in /usr/lib/sasl2/memcached.conf, named per application. An example of this is:

Note: on Ubuntu, this database file is already in existence. If you have to have one created, make sure whatever directory you specify for the location of the sasl database exists prior to running the next command) To add a user to the database file:

As you can see, -a specifies the application, ‘memcached’, which needs to match the name you gave the conf file in the previous step ‘memcached.conf’. When you run this saslpasswd2 command, you will be prompted for a password and password verification as shown below:

You can verify that the user you created now exists. To do so, run:

-or-

You’ll see an output such as:

User-Specific Database File:

The first thing you need to ensure is that you set a very important environment variable, SASL_CONF_PATH whenever you run memcached. In this example, this path will be set to /home/patg/sasl.

Make sure to create whatever directory path you specify! Next, you will set up the memcached.conf file (named per application). In this example, the contents are:

Next you will have to create the database file that you just specified in the previous step in your memcached.conf file.

Notice that the -a flag specifies the name of the application memcached, which must match to the name of the config file you specified in the previous example above, memcached.conf. Also notice that this differs from the system-wide example because you have to specify the database file in this example with the -f flag. When you run saslpasswd2, you will be prompted to enter the password and password verification, as shown in the example below:

Now to run sasldblistusers2 to verify that you in fact added the user. As with saslpasswd2, you will have to specify the database file:

Running SASL-Enabled Memcached

Using either a system-wide database file or user-level database file, you will need to start memcached with the appropriate flags. When memcached runs with SASL enabled, the binary protocol is used, text protocol turned off. In this example, a user-level  database file is used. As the user ‘patg’, the following was done:

Now to use memcached, you will need an enabled client, which as announced in this post, spymemcached (Java) and libmemcached support now. For simplicity (at least for me!) I hacked up one of the tests that come with memcached, binary-sasl.t, and renamed it patg.t (Reminds me I need to add support to Cache::Memcached!) I also had to export an environment variable that the test suite code uses to state that you use an existing running memcached server:

Then I ran my test:

Of interest and worth pointing out, notice the list_mechs test. This test lists what your authentication mechanisms your server is configured for. What is of interest to me here is that I see my running server authenticating, since I started the test with -vvv. A failed authentication:

A successful authentication:

A successful GET using authentication:

The server is working! Now to try out SASL memcached using libmemcached.

Installing Libmemcached

The first thing to install libmemcached with Trond’s new functionality is to clone his tree from Launchpad. You will need the bazaar revision control system for this. For Ubuntu, it is:

Next, clone the tree:

This installs libmemcached. Now, how do you use it? Well, you will have to write programs to utilize it. For my enjoyment, I wrote a simple C program that uses the information Trond provided on his post. I called it sasl_test.c which you can find on Northscale’s downloads. The crux of what it contains is shown below. I have a main function that contains these important lines:

Then, per Trond’s instructions (lifted from his page), added callbacks, which I declare in another file I have sasl_test.h

Then I defined these in callbacks sasl_test.c (notice the password is set according to what was added to the sasl db file):

I compile this with the following command:

Then I can run the test!

If I observe my SASL-enabled memcached server, I see that authentication works. Connection:

Authentication:

Set, authenticated:

Get, authenticated:

And it works! Now I can modify other libmemcached-based programs accordingly. Of course, you could also use spymemcached.

Summary

With this post, you should come away having a better understanding of what SASL is, and how you can use it with memcached. You should be fully able to now obtain, compile and install both the memcached server as well as the client, libmemcached with SASL enabled, as well as be able to start writing memcached applications that use libmemcached. Have fun!