Security Considerations

NCache has a straightforward installation process, but certain administrative privileges are required to ensure secure and proper installation. This page outlines the necessary rights and permissions required during installation, for services, and for client-side logging, covering both Windows and Linux systems. Adhering to these security guidelines ensures that NCache is installed securely while following the principle of least privilege wherever possible.

Note

During the installation process, NCache has an option that allows you to configure your Firewall and system ports for you. You can learn more about it in the section on Firewalls and Ports.

Rights Necessary for Installation

Windows Installation

Only users with Administrator privileges, or those part of the Administrators group, can install NCache on Windows. This is primarily due to NCache registering performance counters under PerfMon, which requires administrative access.

Linux Installation

Similarly, for Linux, an admin-level user is required to run the NCache installer (typically a root user or a user with sudo privileges). The installer places files in system directories, such as /opt/ncache, which are owned by the root user. Post-installation, no further administrative rights are required to run NCache, as it can operate without admin privileges.

Rights Necessary for Services

Windows Services

For NCache services to run correctly, the account under which the services are started needs to have administrative rights, but not necessarily be the system Administrator account. This is required so that NCache can properly publish performance counters in PerfMon.

Additionally, for NCache to capture and log performance data at runtime, the user under which NCache is running must be part of the Performance Log Users group on Windows. This built-in group has the necessary permissions to log performance data. While the service itself requires these privileges, you can specify a non-administrative account to run the services as long as it has the necessary rights to interact with PerfMon and publish counters.

Linux Services

On Linux, NCache services are typically run under a user account created by the installer. The installer ensures that the user has sufficient permissions to interact with the system. The installer creates a dedicated ncache user for this purpose, granting all necessary permissions to the NCache directories.

Rights Necessary for Client Logs

Client-Side Logging on Windows

NCache provides an option to enable client-side logging through the client.ncconf file. When enabled, errors and logs are written to the ClientLogs sub-folder on the installation path, such as C:\Program Files\NCache\log-files\, if the NCache installation exists. This sub-folder is created at runtime when the first client with client-side logging enabled connects to a cache from the same machine.

If NCache is not installed on the client machine, the client will attempt to write logs in the current directory where it is running, which might not be ideal. In such cases, users can specify a custom log path to store logs in a directory of their choosing (either on the local machine or a remote path). Additionally, if you are using an inProc client cache the client cache by deafult looks for the NCache installation folder to create logs.

For the client to write logs successfully, the user under which the NCache client is running (whether console-based, UI-based, or web-based) must have write permissions for the log directory. Additionally, the user must have the necessary permissions to publish performance counters.

For web-based applications running in IIS (Internet Information Services), special attention must be given to the App Pool Identity. By default, IIS uses a limited user account with restricted permissions. If you want to log to the NCache installation directory, the App Pool Identity must have write access to the NCache folder. This is critical for applications running in IIS, web servers, or other web-based environments where logging to the NCache directory is required.

Client-Side Logging on Linux

For Linux systems, upon installation Linux assigns the ownership of the /opt/ncache/log-files folder to the ncache user. However, if another application is already running under a different user, that user may not have the appropriate permissions to interact with the NCache service or write to log files. Once logging is enabled, NCache creates a subfolder called ClientLogs in /opt/ncache/log-files. This sub-folder is created whenever the first client with client-side logging enabled connects with a cache from the same box by the installer at runtime.

However, if your application is running under a user that does not have permission to write to /opt/ncache/log-files, the logs may not be created in the correct location. This is especially important for in-process clients that expect to find the NCache installation folder and write logs there. If NCache cannot find the installation path or if no custom path has been configured, the client will start creating logs in the current directory.

Note

To use the NCache File Dependency, the NCache process needs permission to read the dependency files. Thus, must run under a user account that has permission to access the files in question.

See Also

Data Encryption
SSL/TLS Encryption
HTTPS for the NCache Management Center