Hardening Memcached

Memcached has no authentication and no authorization in its default build. Not weak defaults — absent ones. Anything that can open a TCP connection to port 11211 can read every key, overwrite every value, and flush the entire cache.

That places it alongside MongoDB rather than Redis: there is no requirepass equivalent switched on out of the box, and no protected-mode safety net watching for the obvious mistake. The network boundary is not the first control here. Until you turn something on, it is the only one.

// memcached checklist — 6 controls

• Bind Memcached to localhost
• Require authentication on Memcached
• Memcached UDP is already off — check, don't configure
• Enable TLS on Memcached
• Run Memcached as a non-root user
• Set Memcached limits and leave shutdown disabled

Controls

01Bind Memcached to localhostAn open port that hands every cached value to anyone who connectsSeverity: critical02Require authentication on MemcachedAnything that reaches the port can read and overwrite every cached valueSeverity: high03Memcached UDP is already off — check, don't configureA pre-1.5.6 daemon acting as a DDoS reflector for anyone who finds itSeverity: medium04Enable TLS on MemcachedCached values and credentials readable by anything on the network pathSeverity: medium05Run Memcached as a non-root userA bug in a network-facing daemon executing with full host privilegesSeverity: medium06Set Memcached limits and leave shutdown disabledA cache that exhausts host memory, or an unauthenticated command that drops itSeverity: low

Check what you actually have

Memcached has no fork or licence drama — it is BSD-licensed and there is one implementation. What it has instead is a three-way split in defaults, and the split decides whether your install is already exposed:

How it was installed	Listens on	Runs as
Built from source (upstream default)	All interfaces (INADDR_ANY)	Refuses to start as root without -u
Debian / Ubuntu package	127.0.0.1 and ::1	memcache
Official Docker image	All interfaces — no -l is passed	memcache

So “memcached is safe by default now” and “memcached listens to the world by default” are both true statements about different installs, which is why the advice online contradicts itself.

The Debian and Ubuntu packages ship -l 127.0.0.1 and -l ::1 in /etc/memcached.conf, and memcached’s own DDoS advisory notes this. A source build or a container does not get that, because the flag lives in the distribution’s config file, not in the daemon.

memcached --version
ss -lntup | grep 11211

The second command is the one that answers the question. See bind to localhost.

Version

1.6.45 is current (2026-07-09). Two version boundaries matter more than the rest:

• 1.5.6 (2018) — UDP disabled by default, the response to the Memcrashed amplification attacks. Below this line, a stock memcached is a DDoS reflector. See the threat page.
• 1.5.13 — TLS support added, and only when the binary was built with --enable-tls.

Both authentication and TLS are build-time options. A binary that was not compiled with them cannot be configured into having them, and the errors it gives when you try are covered on the relevant pages. Check before planning around either:

memcached -h | grep -E '^-S|^-Y|^-Z'

Where the config lives

There is no config file in upstream memcached — it is configured entirely by command-line flags. What looks like a config file is the distribution’s way of assembling those flags:

Platform	File
Debian / Ubuntu	/etc/memcached.conf (one flag per line)
RHEL / Fedora	/etc/sysconfig/memcached (OPTIONS= string)
Container	the command: / CMD in your compose file or manifest

The consequence: the running process is the only source of truth. A flag added to a file that the unit does not read changes nothing, and there is no memcached -t to validate it.

ps -o args= -C memcached

Restarting

Memcached has no reload. Every change is a restart, and a restart discards the entire cache — it is memory only, with no persistence. That is usually survivable, but it means a thundering herd of cache misses hits whatever is behind it.

sudo systemctl restart memcached

Restart during low traffic, and make sure the backing store can absorb a cold cache before you do.