Bind Memcached to localhost

The fix/etc/memcached.conf

-l 127.0.0.1
-l ::1

sudo systemctl restart memcached

On RHEL and Fedora the same setting goes in OPTIONS in /etc/sysconfig/memcached; in a container it goes in the command:.

Why this is the first control

Because in memcached’s default build there is nothing behind it. No password, no ACL, no protected mode. A TCP connection to 11211 is a complete grant:

# From anywhere that can reach the port
printf 'stats items\r\n' | nc target 11211      # what keys exist
printf 'get session:abc123\r\n' | nc target 11211  # read a value
printf 'flush_all\r\n' | nc target 11211        # drop the entire cache

None of that requires a credential, because there is no credential to require. Authentication is available — see require authentication — but it is off by default and, for SASL, needs a binary built for it. Until then the listening address is the access control.

The upstream default is INADDR_ANY, which is every interface the host has. The help text says so plainly: -l, --listen=<addr> interface to listen on (default: INADDR_ANY).

Loopback, or a private address

If the only clients are on the same host — the common case for a single-server application — loopback is correct and complete:

-l 127.0.0.1
-l ::1

Include the IPv6 line. A host that resolves localhost to ::1 will fail to connect if only the IPv4 loopback is bound, and the usual reaction to that failure is to widen the binding rather than add one line. The Debian package ships both for this reason.

If clients are on other hosts, bind the specific private address — never 0.0.0.0:

-l 10.0.1.20

Binding a private address is not a substitute for a firewall. It means the daemon ignores traffic arriving on other interfaces; it does not stop anything that can already route to 10.0.1.20. On a cloud network where the whole VPC can reach that address, you still need a security group.

The Unix socket option

If every client is genuinely local, memcached can skip the network entirely:

-s /var/run/memcached/memcached.sock
-a 0770

The help text is explicit that -s disables network support — there is no port at all, and access is decided by filesystem permissions with -a as the octal mask. This is the strongest available answer for a single-host deployment, and it removes the exposure rather than narrowing it.

It rules out remote clients completely, and not every client library speaks Unix sockets, so check yours first.

Verify it worked

The config file is not the answer. Ask the kernel what is actually bound:

ss -lntup | grep 11211

Expect 127.0.0.1:11211 and [::1]:11211. 0.0.0.0:11211 or *:11211 means it is on every interface — including the public one, if the host has a public address.

Confirm the flags the running process actually received, which is what matters when a config file might not be read:

ps -o args= -C memcached

Then prove it from another host — the only test that is not self-reported:

nc -vz YOUR_SERVER_IP 11211

Expect a refused connection or a timeout. If it connects, try printf 'stats\r\n' | nc YOUR_SERVER_IP 11211 — a reply means anyone on that network can read your cache.

In a container, -p 11211:11211 publishes the port to every interface on the host regardless of what memcached binds inside. Bind the host side too:

docker run -p 127.0.0.1:11211:11211 memcached

Before you apply this

This is the change most likely to take an application down, because moving from all-interfaces to loopback disconnects every remote client at once — and memcached has no reload, so it is a restart, and a restart empties the cache.

Find out who is connecting before you change anything:

ss -tnp | grep 11211
printf 'stats\r\n' | nc 127.0.0.1 11211 | grep -E 'curr_connections|cmd_get'

If curr_connections is higher than the local clients you know about, something remote is using it. Identify it before you cut it off.

Plan for the cold cache. Every key is gone on restart and the backing database absorbs the full read load until it refills — on a busy site that is the actual risk of this page, not the binding change itself. Restart at a quiet hour and watch the database.

If remote clients are legitimate, bind the private interface rather than loopback, and add the firewall rule in the same change:

sudo ufw allow from 10.0.1.0/24 to any port 11211 proto tcp

Related

• Require authentication — the layer that should be behind the binding.
• Exposed to the internet — what an open 11211 has actually been used for.