Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Use AWS ElastiCache AutoDiscovery or Google Cloud MemoryStore Auto Discovery to automatically configure your Dalli memcached client with all the nodes in your cluster.
Install the gem:
# in your Gemfile
gem 'dalli-elasticache'
Note that the list of memcached servers used by Rails will be refreshed each time an app server process starts. If the list of nodes in your cluster changes, this configuration will not be reflected in the Rails configuraiton without such a server process restart.
The most common use of Dalli in Rails is to support a cache store. To set up your cache store with a cluster, you'll need to generate the list of servers with Dalli ElastiCache and pass them to the cache_store
configuration. This needs to be done in your config/environments/RAILS_ENV.rb
file for each Rails environment where you want to use a cluster.
# in config/environments/production.rb
endpoint = "my-cluster-name.abc123.cfg.use1.cache.amazonaws.com:11211"
elasticache = Dalli::ElastiCache.new(endpoint)
config.cache_store = :mem_cache_store, elasticache.servers, { expires_in: 1.day }
Another use of Dalli in Rails is to support a Rails session store. Dalli ElastiCache can also be used in this case. The usage is very similar - first use Dalli ElastiCache to generate the list of servers, and then pass that result to the Rails configuration. In config/application.rb
you would write:
# in config/environments/production.rb
endpoint = "my-cluster-name.abc123.cfg.use1.cache.amazonaws.com:11211"
elasticache = Dalli::ElastiCache.new(endpoint)
config.session_store = :mem_cache_store, memcache_server: elasticache.servers, pool_size: 10, pool_timeout: 5, expire_after: 1.day
Please see here for more information on configuring Dalli and Rails.
To initialize a Dalli Client the is configured for all the nodes of a cluster, one simply needs to pass the configuration endpoint and any options for the Dalli Client into the Dalli::ElastiCache
initializer. Then one can use the methods on the Dalli::ElastiCache
object to generate an appropriately configured Dalli::Client
or to get information about the cluster.
config_endpoint = "aaron-scratch.vfdnac.cfg.use1.cache.amazonaws.com:11211"
# Options for configuring the Dalli::Client
dalli_options = {
expires_in: 24 * 60 * 60,
namespace: "my_app"
}
elasticache = Dalli::ElastiCache.new(config_endpoint, dalli_options)
Fetch information about the Memcached nodes:
# Dalli::Client with configuration from the AutoDiscovery endpoint
elasticache.client
# => #<Dalli::Client ... @servers=["aaron-scratch.vfdnac.0001.use1.cache.amazonaws.com:11211", ...]>
# Node addresses
elasticache.servers
# => ["aaron-scratch.vfdnac.0001.use1.cache.amazonaws.com:11211", "aaron-scratch.vfdnac.0002.use1.cache.amazonaws.com:11211"]
# Number of times the cluster configuration has changed
elasticache.version
# => 12
# Memcached version of the cluster
elasticache.engine_version
# => "1.4.14"
# Refresh data from the endpoint
elasticache.refresh
# Refresh and get client with new configuration
elasticache.refresh.client
Copyright (2017-2022) Aaron Suggs, Peter M. Goldstein. See LICENSE for details.
FAQs
Unknown package
We found that dalli-elasticache demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.