Memcached 1.6.24

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Redis, Memcached & Key-Value Stores and Caches AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose Memcached 1.6.24 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large recommended; the software charge is $0.04 per vCPU per hour) and your key pair.
• Set the security group. The listing's default group allows SSH (22) only. Restrict it to your own IP address.
• Choose your VPC and subnet, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run the command below on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the security group, subnet and key pair with your own. The security group should allow SSH from your management address only.

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=memcached}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

Connect as ubuntu with the key pair you chose.

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within seconds of launch. It generates the instance's SASL password and writes it, with the user name and server address, to /root/memcached-credentials.txt. Show the file without the password line:

sudo grep -v '^MEMCACHED_PASSWORD=' /root/memcached-credentials.txt

# Memcached 1.6.24 (sac) - generated on this instance's first boot. Root only (0600). # SASL PLAIN over the memcached binary protocol. memcached listens on 127.0.0.1:11211 only; UDP is off. # Rotate the password: edit MEMCACHED_PASSWORD below, then run:
sudo systemctl restart memcached MEMCACHED_USER=sac MEMCACHED_SERVER=127.0.0.1:11211

To print the password itself for your application's configuration, run sudo sed -n 's/^MEMCACHED_PASSWORD=//p' /root/memcached-credentials.txt. Treat it like any other secret.

Check that memcached.service and its first-boot unit are active. Then run the self-test, which proves that the cache works with this instance's credential and is private. It checks the version, that requests without a password or with a wrong one are refused, that the ASCII protocol is refused, a store, read and delete round trip, the exact listening sockets, that nothing answers on UDP, and that the instance's private IP refuses port 11211.

systemctl is-active memcached.service memcached-firstboot.service
sudo /usr/local/sbin/memcached-selftest

active active ok: memcached version 1.6.24 ok: unauthenticated GET/SET refused (AUTH_ERROR 0x20) ok: wrong password refused (0x20); this instance's credential accepted on the same raw path ok: ASCII protocol refused ok: pylibmc SET/GET/DELETE with this instance's credential; wrong password refused ok: TCP listeners exactly 127.0.0.1:11211; no UDP listener and no UDP answer ok: private IP 172.31.83.193 refuses 11211 (22 answers) SELFTEST_OK

The configuration is in /etc/memcached.conf. Memcached listens on loopback TCP only:

grep -v '^#' /etc/memcached.conf
sudo ss -tulpn | grep memcached

-m 64 -p 11211 -U 0 -l 127.0.0.1 -u memcache -c 1024 -S -B binary tcp LISTEN 0 1024 127.0.0.1:11211 0.0.0.0:* users:(("memcached",pid=834,fd=26))

In this file, -m is the cache size in MB and -c is the connection limit. -U 0 turns UDP off, -S requires SASL, and -B binary selects the binary protocol that SASL needs.

Run the Python example below. It uses pylibmc, which is installed on the image. The script reads the credential from the root-only file, so the password never appears on a command line. It stores a value, increments a counter and reads the server statistics.

sudo python3 - <<'PY' import pylibmc creds = {} for line in open("/root/memcached-credentials.txt"): if "=" in line and not line.startswith("#"): key, value = line.strip().split("=", 1) creds[key] = value mc = pylibmc.Client(["127.0.0.1:11211"], binary=True, username=creds["MEMCACHED_USER"], password=creds["MEMCACHED_PASSWORD"]) mc.set("greeting", "hello from sac", time=300) print("greeting =", mc.get("greeting")) mc.set("page_views", 0) mc.incr("page_views", 5) print("page_views =", mc.get("page_views")) stats = {k: v.decode() for k, v in mc.get_stats()[0][1].items()} print("version", stats["version"], "| curr_items", stats["curr_items"], "| limit_maxbytes", stats["limit_maxbytes"]) mc.delete_multi(["greeting", "page_views"]) PY

greeting = hello from sac page_views = 5 version 1.6.24 | curr_items 2 | limit_maxbytes 67108864

time=300 makes the entry expire after five minutes. Without it, an entry stays until Memcached needs the memory for something newer.

The libmemcached-tools commands take the credential as options. Run memcstat to print the server statistics:

PASS="$(sudo sed -n 's/^MEMCACHED_PASSWORD=//p' /root/memcached-credentials.txt)" memcstat --servers=127.0.0.1:11211 --binary --username=sac --password="$PASS" | grep -E 'Server:|pid|version|curr_connections|limit_maxbytes|threads' unset PASS

Server: 127.0.0.1 (11211) pid: 5311 version: 1.6.24 curr_connections: 1 limit_maxbytes: 67108864 threads: 4

Command-line options are visible to other users of the instance while the command runs. Prefer a client library that reads the password from a file or your application's secret store.

Try a wrong password and a plain-text request. Memcached refuses the wrong password. A plain-text request without a password gets no answer, because Memcached closes the connection.

memcstat --servers=127.0.0.1:11211 --binary --username=sac --password=wrong-password || echo "memcstat refused (exit $?)" printf 'stats\r\n' | nc -w 2 127.0.0.1 11211 | wc -c

Failed to 'STAT ': (0x7ffe13914ab0) AUTHENTICATION FAILURE, host: 127.0.0.1:11211 -> ./src/libmemcached/sasl.cc:257 memcstat refused (exit 1) 0

The image gives Memcached 64 MB. Set -m in /etc/memcached.conf to the memory, in MB, that you want the cache to use. Leave room for the operating system. On an 8 GiB m5.large, -m 6144 is a reasonable start. For example, run sudo sed -i 's/^-m .*/-m 6144/' /etc/memcached.conf, then apply the change with sudo systemctl restart memcached.

Raise -c the same way if your applications open more than 1024 connections.

Restarting Memcached empties the cache. Your application should treat every key as optional and rebuild it from the real data source on a miss.

If your application runs on the same instance as Memcached, you need nothing more. To let application servers on other instances use the cache, add the instance's private IP to the -l line. Keep 127.0.0.1, and keep -S (authentication) and -U 0 (UDP off):

PRIVATE_IP=<private-ip>
sudo sed -i "s/^-l 127.0.0.1$/-l 127.0.0.1,${PRIVATE_IP}/" /etc/memcached.conf
sudo systemctl restart memcached
sudo ss -tlnp | grep memcached
sudo /usr/local/sbin/memcached-selftest

The self-test then checks that the private IP still demands the password. Never use 0.0.0.0, because the self-test rejects a wildcard listener.

In the instance's security group, add an inbound rule for TCP 11211 from your application servers' security group or subnet only. Never open it to 0.0.0.0/0.

Point your clients at <private-ip>:11211 with the user SecureAnyCloud and the password from Step 2.

The Memcached binary protocol is not encrypted. Keep this traffic inside your VPC (security groups, private subnets), or run Memcached on the same instance as the application.

Use any client that supports SASL over the Memcached binary protocol. Connect to 127.0.0.1:11211 (or the private IP from Step 7) with the user SecureAnyCloud and the password from Step 2. Keep the password in your application's secret store or in an environment file that only the application can read, never in source code. For example:

• Python (pylibmc): pylibmc.Client(["127.0.0.1:11211"], binary=True, username="SecureAnyCloud", password=PASSWORD)
• PHP (php-memcached): $m->setOption(Memcached::OPT_BINARY_PROTOCOL, true); $m->setSaslAuthData("SecureAnyCloud", $password);
• Ruby (dalli): Dalli::Client.new("127.0.0.1:11211", username: "SecureAnyCloud", password: password)

Clients that speak only the plain-text protocol, or that do not support SASL, cannot authenticate and are refused.

The credential file is the source of truth. Memcached rebuilds its SASL entry from it every time it starts. To set a new password, replace the value of MEMCACHED_PASSWORD (at least 16 characters, no spaces) and restart Memcached:

sudo sed -i 's/^MEMCACHED_PASSWORD=.*/MEMCACHED_PASSWORD=<new-password>/' /root/memcached-credentials.txt
sudo systemctl restart memcached
sudo /usr/local/sbin/memcached-selftest

Then update your applications. You can safely change the instance's hostname, because the SASL entry follows the hostname on the next restart.

Memcached and its first-boot unit carry a systemd rule that drops traffic to the instance metadata service, so nothing running inside them can read instance credentials. Confirm the rule:

systemctl show -p IPAddressDeny memcached.service memcached-firstboot.service

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

• Keep port 11211 closed to the internet. Memcached is a cache for your own applications. Open it only to your application servers (Step 7), and open SSH only to your management address.
• Keep authentication on and UDP off. Leave -S and -U 0 in /etc/memcached.conf. Exposed Memcached servers without them are widely abused for data leaks and DDoS amplification.
• Never store the only copy of data in Memcached. Everything in it disappears on a restart or under memory pressure.
• Rotate the password if it may have been exposed (Step 9).
• Keep the OS and Memcached patched. Unattended security upgrades are on. Restart Memcached after a Memcached update.
• Watch the statistics. memcstat reports hits, misses, evictions and memory use for your monitoring system.