Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

8.7. Securing the Memcached service

To secure the Memcached caching service against denial-of-service (DoS) attacks and unauthorized access, configure it to accept only local traffic and enable user authentication. This prevents DDoS amplification and ensures only authorized clients access stored data.

Memcached is an open source, high-performance, distributed memory object caching system. It can improve the performance of dynamic web applications by lowering database load.

Memcached is an in-memory key-value store for small chunks of arbitrary data, such as strings and objects, from results of database calls, API calls, or page rendering. Memcached allows assigning memory from underutilized areas to applications that require more memory.

In 2018, vulnerabilities of DDoS amplification attacks by exploiting Memcached servers exposed to the public internet were discovered. These attacks took advantage of Memcached communication that uses the UDP protocol for transport. The attack was effective because of the high amplification ratio, where a request with the size of a few hundred bytes could generate a response of a few megabytes or even hundreds of megabytes in size.

In most situations, you do not need to expose the memcached service to the public internet. Public exposure might cause security problems, making it possible for remote attackers to leak or modify information stored in Memcached.

8.7.1. Memcached hardening against DDoS attacks
リンクのコピー

Harden the Memcached service against distributed denial-of-service (DDoS) attacks. This helps prevent attackers from overwhelming the service and degrading performance.

To mitigate security risks, perform as many of the following steps as applicable for your configuration:

  • Configure a firewall in your LAN. If your Memcached server should be accessible only in your local network, do not route external traffic to ports used by the memcached service. For example, remove the default port 11211 from the list of allowed ports: 

    # firewall-cmd --remove-port=11211/udp
# firewall-cmd --runtime-to-permanent

  • If you use a single Memcached server on the same machine as your application, set up memcached to listen to localhost traffic only. Modify the OPTIONS value in the /etc/sysconfig/memcached file: 

    OPTIONS="-l 127.0.0.1,::1"

  • Enable Simple Authentication and Security Layer (SASL) authentication:

    1. Modify or add the /etc/sasl2/memcached.conf file: 

      sasldb_path: /path.to/memcached.sasldb

    2. Add an account in the SASL database: 

      # saslpasswd2 -a memcached -c cacheuser -f /path.to/memcached.sasldb

    3. Ensure that the database is accessible for the memcached user and group: 

      # chown memcached:memcached /path.to/memcached.sasldb

    4. Enable SASL support in Memcached by adding the -S value to the OPTIONS parameter in the /etc/sysconfig/memcached file: 

      OPTIONS="-S"

    5. Restart the Memcached server to apply the changes: 

      # systemctl restart memcached
    6. Add the username and password created in the SASL database to the Memcached client configuration of your application.

  • Encrypt communication between Memcached clients and servers with TLS:

    1. Enable encrypted communication between Memcached clients and servers with TLS by adding the -Z value to the OPTIONS parameter in the /etc/sysconfig/memcached file: 

      OPTIONS="-Z"
    2. Add the certificate chain file path in the PEM format using the -o ssl_chain_cert option.
    3. Add a private key file path using the -o ssl_key option.
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る