
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Use AWS ElastiCache AutoDiscovery or Google Cloud MemoryStore Auto Discovery to automatically configure your Dalli memcached client with all the nodes in your cluster.
Install the gem:
# in your Gemfile
gem 'dalli-elasticache'
Note that the list of memcached servers used by Rails will be refreshed each time an app server process starts. If the list of nodes in your cluster changes, this configuration will not be reflected in the Rails configuraiton without such a server process restart.
The most common use of Dalli in Rails is to support a cache store. To set up your cache store with a cluster, you'll need to generate the list of servers with Dalli ElastiCache and pass them to the cache_store
configuration. This needs to be done in your config/environments/RAILS_ENV.rb
file for each Rails environment where you want to use a cluster.
# in config/environments/production.rb
endpoint = "my-cluster-name.abc123.cfg.use1.cache.amazonaws.com:11211"
elasticache = Dalli::ElastiCache.new(endpoint)
config.cache_store = :mem_cache_store, elasticache.servers, { expires_in: 1.day }
Another use of Dalli in Rails is to support a Rails session store. Dalli ElastiCache can also be used in this case. The usage is very similar - first use Dalli ElastiCache to generate the list of servers, and then pass that result to the Rails configuration. In config/application.rb
you would write:
# in config/environments/production.rb
endpoint = "my-cluster-name.abc123.cfg.use1.cache.amazonaws.com:11211"
elasticache = Dalli::ElastiCache.new(endpoint)
config.session_store = :mem_cache_store, memcache_server: elasticache.servers, pool_size: 10, pool_timeout: 5, expire_after: 1.day
Please see here for more information on configuring Dalli and Rails.
To initialize a Dalli Client the is configured for all the nodes of a cluster, one simply needs to pass the configuration endpoint and any options for the Dalli Client into the Dalli::ElastiCache
initializer. Then one can use the methods on the Dalli::ElastiCache
object to generate an appropriately configured Dalli::Client
or to get information about the cluster.
config_endpoint = "aaron-scratch.vfdnac.cfg.use1.cache.amazonaws.com:11211"
# Options for configuring the Dalli::Client
dalli_options = {
expires_in: 24 * 60 * 60,
namespace: "my_app"
}
elasticache = Dalli::ElastiCache.new(config_endpoint, dalli_options)
Fetch information about the Memcached nodes:
# Dalli::Client with configuration from the AutoDiscovery endpoint
elasticache.client
# => #<Dalli::Client ... @servers=["aaron-scratch.vfdnac.0001.use1.cache.amazonaws.com:11211", ...]>
# Node addresses
elasticache.servers
# => ["aaron-scratch.vfdnac.0001.use1.cache.amazonaws.com:11211", "aaron-scratch.vfdnac.0002.use1.cache.amazonaws.com:11211"]
# Number of times the cluster configuration has changed
elasticache.version
# => 12
# Memcached version of the cluster
elasticache.engine_version
# => "1.4.14"
# Refresh data from the endpoint
elasticache.refresh
# Refresh and get client with new configuration
elasticache.refresh.client
Copyright (2017-2022) Aaron Suggs, Peter M. Goldstein. See LICENSE for details.
FAQs
Unknown package
We found that dalli-elasticache demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.