Run Memcached as a non-root user

The fix/etc/memcached.conf

-u memcache

If you see this

must add '-u root' to start as root

Memcached was launched by root with no -u flag and refused to continue. It is asking you to either name an unprivileged user or state that you really meant root. — memcached/memcached.c

The default is on your side here

Memcached will not silently run as root. If it is started by root and no -u is given, it refuses and says so:

must add '-u root' to start as root

That is a genuinely good default and it does real work — it makes running as root a deliberate, typed-out decision rather than something that happens when nobody was paying attention. This is the same shape as Apache’s defaults: the interesting failure is not the default, it is somebody having overridden it.

So the finding on this page is rarely “nobody set -u”. It is usually -u root sitting in a config file, added years ago to make an error go away.

Why it matters for this daemon in particular

Memcached parses attacker-controlled input on a network socket, and it does so with no authentication in front of it in the default build. That combination is exactly the one where the runtime user decides whether a parsing bug is a contained problem or a host compromise.

It is rated medium rather than higher because the defaults already handle it on almost every install — the packages set -u memcache, and the official Docker image declares USER memcache. The value of this page is the check, not the change.

Where it is already handled

Install	User
Debian / Ubuntu package	-u memcache in /etc/memcached.conf
Official Docker image	USER memcache in the image
Built from source, run by hand	Whatever you pass — refuses root without -u

The container case is worth stating because it is the one people assume is weakest and is not: the official image already drops to an unprivileged user. If you build your own image from source, that is where the guarantee disappears.

What this does not protect

Nothing about the data. An unprivileged memcached still hands every cached value to anyone who can reach the port, because the user it runs as has no bearing on protocol-level access. This control limits the blast radius of a bug in the daemon; it does not add a single access check.

That ordering is why it sits below binding and authentication on the checklist.

Verify it worked

The config file is not the answer — check the process:

ps -o user,args -C memcached

Expect memcache (or nobody on some distributions), not root.

Look for an explicit override, which is the actual finding:

grep -rn '^-u' /etc/memcached.conf /etc/sysconfig/memcached 2>/dev/null

-u root is the thing to remove.

In a container, check the effective user inside it:

docker exec YOUR_CONTAINER id

Expect uid=11211(memcache), not uid=0(root). A custom image built from source will not have this unless you added a USER line.

Confirm the data directory and any auth or certificate files are owned appropriately:

ls -l /etc/memcached.auth /etc/memcached/certs/ 2>/dev/null

Before you apply this

Low risk, with two specific things to check.

Ports below 1024. If somebody moved memcached to a privileged port, dropping privileges means it can no longer bind. There is rarely a reason to do this — 11211 is the convention and nothing gains from changing it — but if you inherited such a config, move the port back rather than granting the daemon root.

File ownership. Anything memcached opens after dropping privileges must be readable by the runtime user. The TLS key is the usual one, and unlike a web server memcached does not read it as root first:

sudo -u memcache test -r /etc/memcached/certs/server.key && echo readable

The pid file directory needs to be writable by that user too, which is why the packages create /var/run/memcached owned by memcache.

Changing the user means a restart, and a restart empties the cache. Nothing about this control is urgent enough to justify a cold cache during peak traffic — fold it into the next restart you are already taking for binding.

Related

• Bind Memcached to localhost — the control that limits who can reach the process at all.
• Set memory and connection limits — the other operational guard rails.