Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

8.7. Securing the Memcached service

To secure the Memcached caching service against denial-of-service (DoS) attacks and unauthorized access, configure it to accept only local traffic and enable user authentication. This prevents DDoS amplification and ensures only authorized clients access stored data.

Memcached is an open source, high-performance, distributed memory object caching system. It can improve the performance of dynamic web applications by lowering database load.

Memcached is an in-memory key-value store for small chunks of arbitrary data, such as strings and objects, from results of database calls, API calls, or page rendering. Memcached allows assigning memory from underutilized areas to applications that require more memory.

In 2018, vulnerabilities of DDoS amplification attacks by exploiting Memcached servers exposed to the public internet were discovered. These attacks took advantage of Memcached communication that uses the UDP protocol for transport. The attack was effective because of the high amplification ratio, where a request with the size of a few hundred bytes could generate a response of a few megabytes or even hundreds of megabytes in size.

In most situations, you do not need to expose the memcached service to the public internet. Public exposure might cause security problems, making it possible for remote attackers to leak or modify information stored in Memcached.

8.7.1. Memcached hardening against DDoS attacks
复制链接

Harden the Memcached service against distributed denial-of-service (DDoS) attacks. This helps prevent attackers from overwhelming the service and degrading performance.

To mitigate security risks, perform as many of the following steps as applicable for your configuration:

  • Configure a firewall in your LAN. If your Memcached server should be accessible only in your local network, do not route external traffic to ports used by the memcached service. For example, remove the default port 11211 from the list of allowed ports: 

    # firewall-cmd --remove-port=11211/udp
# firewall-cmd --runtime-to-permanent

  • If you use a single Memcached server on the same machine as your application, set up memcached to listen to localhost traffic only. Modify the OPTIONS value in the /etc/sysconfig/memcached file: 

    OPTIONS="-l 127.0.0.1,::1"

  • Enable Simple Authentication and Security Layer (SASL) authentication:

    1. Modify or add the /etc/sasl2/memcached.conf file: 

      sasldb_path: /path.to/memcached.sasldb

    2. Add an account in the SASL database: 

      # saslpasswd2 -a memcached -c cacheuser -f /path.to/memcached.sasldb

    3. Ensure that the database is accessible for the memcached user and group: 

      # chown memcached:memcached /path.to/memcached.sasldb

    4. Enable SASL support in Memcached by adding the -S value to the OPTIONS parameter in the /etc/sysconfig/memcached file: 

      OPTIONS="-S"

    5. Restart the Memcached server to apply the changes: 

      # systemctl restart memcached
    6. Add the username and password created in the SASL database to the Memcached client configuration of your application.

  • Encrypt communication between Memcached clients and servers with TLS:

    1. Enable encrypted communication between Memcached clients and servers with TLS by adding the -Z value to the OPTIONS parameter in the /etc/sysconfig/memcached file: 

      OPTIONS="-Z"
    2. Add the certificate chain file path in the PEM format using the -o ssl_chain_cert option.
    3. Add a private key file path using the -o ssl_key option.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部