Memcached UDP is already off — check, don't configure

The fix/etc/memcached.conf

# Explicit, and already the default since 1.5.6
-U 0

If you see this

ERROR: Cannot enable UDP while using binary SASL authentication.

A hard refusal, not a warning — memcached will not start with both. If you hit this you were re-enabling UDP, which is the thing to reconsider. — memcached/memcached.c

The advice is right, and it is also already done

-U 0 opens most memcached hardening guides, usually with the 2018 attacks attached for weight. The line is correct and harmless to add. It is also, on any version released since February 2018, describing something that is already true.

Memcached 1.5.6 disabled UDP by default in response to the Memcrashed amplification attacks. It is visible in the compiled-in defaults — settings.udpport = 0 — and the daemon’s own help text spells the state out:

-U, --udp-port=<num>      UDP port to listen on (default: 0, off)

So the useful action on a current install is not to add the flag. It is to confirm the version, because the flag and the default lead to the same place and only one of the two tells you whether you were ever at risk:

memcached --version

Below 1.5.6, UDP is on and you have a reflector. At or above it, UDP is off unless somebody turned it on.

Why this page is medium and not low

Because the consequence of being on the wrong side of that version line is severe and not aimed at you. An exposed pre-1.5.6 memcached is not primarily a risk to your data — it is a weapon pointed at somebody else, and the traffic it generates is your bandwidth bill.

It stays below binding and authentication because it is conditional: it depends entirely on a version check that most readers will pass.

Adding the flag anyway

Worth doing, for a reason that has nothing to do with the current default: it documents the intent. A future operator reading a config that explicitly says -U 0 knows UDP is meant to be off. One reading a config that says nothing has to know the version history to reach the same conclusion.

It also survives the case where somebody enables UDP for a synthetic benchmark and never removes it.

If you genuinely need UDP — and almost nobody does; the common client libraries default to TCP — then the port must not be reachable from any untrusted network, because UDP source addresses are trivially spoofed and that is the entire basis of the amplification attack.

Verify it worked

The version answers most of the question:

memcached --version

Then confirm what is actually bound, which covers the case where somebody enabled it explicitly:

ss -lnup | grep 11211

Expect no output. Any UDP line on 11211 means it is listening.

ss -lntup shows TCP and UDP together, which is the better habit — it answers this page and the binding page in one command:

ss -lntup | grep 11211

You can also ask the server:

printf 'stats settings\r\n' | nc 127.0.0.1 11211 | grep -i udp

And from outside, confirm nothing answers on UDP:

nc -vzu YOUR_SERVER_IP 11211

UDP has no handshake, so treat a “succeeded” here as inconclusive and trust ss on the host instead.

Before you apply this

Adding -U 0 is safe on any deployment that does not deliberately use UDP, which is nearly all of them — the standard client libraries speak TCP. It costs a restart, and a memcached restart empties the cache, so the cold-cache load on your database is the only real risk of applying it.

Check before assuming nothing uses it:

ss -lnup | grep 11211
printf 'stats\r\n' | nc 127.0.0.1 11211 | grep -i udp

If you are upgrading from below 1.5.6 specifically to get this default, the upgrade itself is the larger change — read the release notes between your version and the target, since several years of behaviour changes are involved.

Do not re-enable UDP to fix a client that suddenly cannot connect after an upgrade. A client that needs UDP is configured wrongly for a modern memcached; point it at TCP instead.

Related

• Exposed to the internet — the attacks this default was a response to.
• Bind Memcached to localhost — the control that makes the UDP question moot.