With the release of Workspace ONE UEM 2410, two additional supplementary configurations were introduced. These options can be configured during the Memcached installation process and are designed to strengthen the security of Memcached communications through encryption and authentication. Each of the following configurations can be applied independently or in combination. Note that implementing any configuration changes will require a service restart.
Use this information to enable and maintain Memcached security configurations.
SSL Encryption
Secure Sockets Layer (SSL) encryption configuration ensures that the communication between Workspace ONE UEM and the caching server are encrypted. This encryption is secured with a certificate credential which must be trusted on both the caching server as well as all Workspace ONE UEM service endpoints.
The certificate used for communication will be entered as part of the installation of the caching service. There is no requirement to upload it to the Workspace ONE UEM Console (application) or deploy it to devices. However, any certificate used during the installation of Memcached must include a DNS name that matches the value specified in the Host field of the Workspace ONE UEM Console and be in the personal and trusted root store of all Workspace ONE UEM application servers.
Note: Enabling this configuration updates the Memcached listener port from the default value of 11211 to 11213. To ensure successful integration of Memcached nodes within Workspace ONE UEM, this port change must also be reflected on the Memcached Configuration page.
Examples:
-
If specifying an IP address such as 10.10.10.10, the certificate’s DNS name must be 10.10.10.10.
-
If specifying a fully qualified domain name (FQDN) such as memcached.omnissa.com, the certificate must be issued to that exact FQDN.
This requirement is essential to ensure proper TLS validation for each connection.
SASL Authentication
Simple Authentication and Security Layer (SASL) Authentication configuration adds an additional security layer of username/password authentication to all caching servers. This configuration is enabled and will prompt for username and password. Username and password set at the console level and used for all communications at the caching endpoint. After configuration in the console is complete, ensure that the caching install is running using the same username and password information.
Note: Any modifications to these configurations require a reinstallation of the Memcached server. During reinstallation, ensure the proper options are selected as both the certificate for SSL and the username/password for SASL are entered. Restart all services after modification of any of these configurations and the subsequent reinstallation.
Maintenance and Rotation
Maintenance and rotation of certificates and password is executed by re-running the Memcached installer.
Note: Omnissa will be releasing a supplementary tool containing the password and certificate rotation functions to ease impact from these regular maintenance activities.
SASL Password Rotation for Memcached
Workspace ONE UEM introduces a supported method for rotating Memcached SASL passwords using a script included with the Memcached installer package. This script updates both the SASL credential store and the Memcached Monitor Service configuration to keep authentication consistent across components.
This section explains the script workflow, prerequisites, usage steps, and troubleshooting guidelines.
What the Script Does
The change-sasl-password.sh script performs the following functions:
- Updates the SASL database (
/etc/sasldb2) with a new password - Updates the Memcached Monitor configuration (
/etc/sysconfig/memcached-monitor) - Temporarily relaxes and then restores secure permissions on configuration files
- Restarts the monitoring service to apply the updated password
This enables SASL password rotation without reinstalling Memcached.
Prerequisites
Before running the script, ensure:
- You have root or sudo privileges
- The following utilities are available on the system:
saslpasswd2sasldblistusers2systemctl
- Standard file paths are in use:
/etc/sasldb2/etc/sysconfig/memcached-monitor
If your environment uses custom paths, update the script accordingly.
How the Script Works
-
Validates required files
Checks for the presence of the SASL database and monitor configuration file. -
Prompts for credentials
- SASL username (for example,
user@omnissa) - New password (input is hidden)
- SASL username (for example,
-
Verifies the username
Ensures the provided username matches the one defined for the monitor service. -
Updates the SASL database
Applies the new password to/etc/sasldb2usingsaslpasswd2. -
Updates monitor service configuration
Inserts the new password into/etc/sysconfig/memcached-monitor. -
Restores file permissions
Resets permissions on the configuration file to its secure defaults. -
Restarts the Memcached Monitor Service
Automatically stops and restartsmemcached-monitorto apply changes.
Usage Instructions
- Run the script:
sudo bash change-sasl-password.sh - Follow the on-screen prompts:
- Enter the SASL username.
- Enter the new password.
The script will display its progress and provide a confirmation message upon successful rotation.
Troubleshooting
Missing File Errors
If /etc/sasldb2 or /etc/sysconfig/memcached-monitor is not found:
- Verify their actual paths on the server.
- Update path variables within the script if your environment uses non-standard locations.
Permission Errors
If permission updates fail:
- Ensure the script is being run with sudo.
- Manually check and correct permissions on the monitor configuration file if necessary.
Monitor Service Does Not Restart
If memcached-monitor fails to restart:
- Review the logs.
- Ensure the password is updated correctly in both the SASL database and configuration file.
Security Notes
- Password input is hidden during entry and is never logged to the console or files.
- File permissions are restored to secure defaults automatically after rotation.
¿Le resultó útil esta página?