8.7. Securing the Memcached service

To secure the Memcached caching service against denial-of-service (DoS) attacks and unauthorized access, configure it to accept only local traffic and enable user authentication. This prevents DDoS amplification and ensures only authorized clients access stored data.

Memcached is an open source, high-performance, distributed memory object caching system. It can improve the performance of dynamic web applications by lowering database load.

Memcached is an in-memory key-value store for small chunks of arbitrary data, such as strings and objects, from results of database calls, API calls, or page rendering. Memcached allows assigning memory from underutilized areas to applications that require more memory.

In 2018, vulnerabilities of DDoS amplification attacks by exploiting Memcached servers exposed to the public internet were discovered. These attacks took advantage of Memcached communication that uses the UDP protocol for transport. The attack was effective because of the high amplification ratio, where a request with the size of a few hundred bytes could generate a response of a few megabytes or even hundreds of megabytes in size.

In most situations, you do not need to expose the memcached service to the public internet. Public exposure might cause security problems, making it possible for remote attackers to leak or modify information stored in Memcached.