Memcached 1.6

Open the Azure Portal, go to the Marketplace and search for Memcached 1.6. Select the SecureAnyCloud publisher entry and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 11211 from your application VMs.

Do not expose port 11211 to the public internet. Even with SASL enabled, brute-force attacks against weak passwords are a real risk. Without TLS, Memcached also sends the password and the cached data in cleartext on the wire.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

RG="memcached-prod" LOCATION="eastus" VM_NAME="memcached-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:memcached-1-6-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create --resource-group "$RG" --name memcached-vnet \
  --address-prefix 10.97.0.0/16 --subnet-name memcached-subnet --subnet-prefix 10.97.1.0/24 az network nsg create --resource-group "$RG" --name memcached-nsg az network nsg rule create --resource-group "$RG" --nsg-name memcached-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create --resource-group "$RG" --nsg-name memcached-nsg \
  --name allow-memcached --priority 110 \
  --source-address-prefixes 10.97.0.0/16 \
  --destination-port-ranges 11211 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:memcached-1-6-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name memcached-vnet --subnet memcached-subnet --nsg memcached-nsg \
  --public-ip-sku Standard

Connect to the VM over SSH:

ssh azureuser@<vm-ip>

By the time you sign in, memcached.service is running and memcached-firstboot.service has generated the SASL credentials.

Check the service status. You should see active (running).

sudo systemctl status memcached.service --no-pager

Confirm the first-boot sentinel file exists:

sudo test -f /var/lib/sac/data/memcached-firstboot.done && echo FIRSTBOOT_DONE

Confirm the listener is bound on port 11211:

sudo ss -tln | grep 11211

By default Memcached binds to 127.0.0.1 only, so the listener shows as LISTEN 0 1024 127.0.0.1:11211.

To allow remote connections, edit /etc/memcached.conf and change -l 127.0.0.1 to -l 0.0.0.0 (or your VM's private IP). Then run sudo systemctl restart memcached.

The first boot generated a SASL user and password specific to this VM and wrote them to a root-only file. Read the file with:

sudo cat /stage/scripts/memcached-credentials.log

The output looks like this:

MEMCACHED_USER=sac MEMCACHED_PASSWORD=<MEMCACHED_PASSWORD> LISTEN_PORT=11211 LISTEN_ADDRESS=127.0.0.1

Store the password in your secret store. Step 12 below explains how to rotate it.

The image ships with libmemcached-tools for command-line access. Read the password from the credentials file and ask the server for its stats. This confirms that the server is reachable and that authentication works.

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /stage/scripts/memcached-credentials.log | cut -d= -f2-) memcstat --binary --username=sac --password="${PASS}" --servers=127.0.0.1:11211 | head -12

Look for Server: 127.0.0.1 (11211) and version: 1.6.24 (or a later 1.6.x).

Now confirm that a wrong password is rejected. The command should print AUTH REJECTED.

memcstat --binary --username=sac --password=wrong --servers=127.0.0.1:11211 2>&1 | grep -qi 'authentication failure' && echo "AUTH REJECTED"

The image ships with python3-pylibmc, a SASL-aware Python client backed by libmemcached. Run the script below to set, get and delete a sample key.

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /stage/scripts/memcached-credentials.log | cut -d= -f2-)
python3 - "${PASS}" <<'PY' import sys, pylibmc password = sys.argv[1] client = pylibmc.Client(["127.0.0.1:11211"], binary=True, username="sac", password=password) client.set("sac:probe", "sac-ok") print("get:", client.get("sac:probe")) client.delete("sac:probe") print("done") PY

The output is get: sac-ok followed by done.

From any host in the same virtual network, install a SASL-capable Memcached client. Then connect on port 11211 with the credentials from Step 5. The examples below cover Python, PHP and Ruby.

Python (apt-get install python3-pylibmc or pip install pylibmc):

import pylibmc client = pylibmc.Client( ["<vm-private-ip>:11211"], binary=True, username="sac", password="<MEMCACHED_PASSWORD>", ) client.set("hello", "world") print(client.get("hello"))

Python with bmemcached (pip install python-binary-memcached):

import bmemcached client = bmemcached.Client( ("<vm-private-ip>:11211",), username="sac", password="<MEMCACHED_PASSWORD>", ) client.set("hello", "world") print(client.get("hello"))

PHP (apt-get install php-memcached):

<?php $mc = new Memcached(); $mc->setOption(Memcached::OPT_BINARY_PROTOCOL, true); $mc->setSaslAuthData("sac", "<MEMCACHED_PASSWORD>"); $mc->addServer("<vm-private-ip>", 11211); $mc->set("hello", "world"); echo $mc->get("hello");

Ruby (gem install dalli):

require 'dalli' client = Dalli::Client.new( '<vm-private-ip>:11211', username: 'sac', password: '<MEMCACHED_PASSWORD>', serializer: JSON, ) client.set('hello', 'world') puts client.get('hello')

Do not open port 11211 to the public internet without TLS termination. The cleartext Memcached protocol exposes both the SASL password (PLAIN mechanism) and the cached data on the wire.

For production traffic across regions, terminate TLS at a reverse proxy, or compile memcached with -Z and a certificate and key pair. Built-in TLS requires Memcached 1.5.13 or later.

These are the files and paths that make up the installation:

• Memcached binary: /usr/bin/memcached
• memcstat: /usr/bin/memcstat
• memcping: /usr/bin/memcping
• memcdump: /usr/bin/memcdump
• Main config: /etc/memcached.conf
• Systemd unit: /usr/lib/systemd/system/memcached.service
• Systemd drop-in: /etc/systemd/system/memcached.service.d/sac-sasl.conf
• SASL config: /etc/sasl2/memcached.conf
• SASL credential database: /etc/sasl2/memcached-sasldb2 (mode 0640, memcache:memcache)
• First-boot script: /usr/local/sbin/memcached-firstboot.sh
• First-boot service: /etc/systemd/system/memcached-firstboot.service
• Credentials file: /stage/scripts/memcached-credentials.log (mode 0600)
• First-boot sentinel: /var/lib/sac/data/memcached-firstboot.done
• Log file: /var/log/memcached.log
• Python SASL client: /usr/lib/python3/dist-packages/pylibmc

To inspect the running version, run:

/usr/bin/memcached --version

Check the service status:

sudo systemctl status memcached.service --no-pager

Stop, start or restart the service:

sudo systemctl stop memcached.service
sudo systemctl start memcached.service
sudo systemctl restart memcached.service

View the log. The Ubuntu memcached daemon writes to the journal:

sudo journalctl -u memcached -n 50 --no-pager

Resize the cache. Memcached must restart to apply the change:

sudo sed -i 's/^-m .*/-m 512/' /etc/memcached.conf
sudo systemctl restart memcached

Listen on a private IP. First scope the source CIDRs in your NSG, then run:

sudo sed -i 's/^-l 127.0.0.1$/-l 0.0.0.0/' /etc/memcached.conf
sudo systemctl restart memcached

Flush the entire cache. This removes every key:

PASS=$(sudo grep '^MEMCACHED_PASSWORD=' /stage/scripts/memcached-credentials.log | cut -d= -f2-) memcflush --binary --username=sac --password="${PASS}" --servers=127.0.0.1:11211

SASL_AUTHENTICATION_FAILED from a client

• Confirm the password is current: sudo cat /stage/scripts/memcached-credentials.log
• Confirm SASL is enabled: grep '^-S' /etc/memcached.conf
• Confirm the sasldb entry exists: sudo sasldblistusers2 -f /etc/sasl2/memcached-sasldb2

Connection refused on port 11211

• Check whether the service is down: sudo systemctl status memcached
• Check whether the listener uses a different port or address: sudo ss -tln | grep 11211
• Check for a firewall block: review your NSG rules and the host firewall

Cache evicting items unexpectedly

• The default -m 64 is small. Raise it with -m in /etc/memcached.conf and restart the service.
• Inspect eviction stats: memcstat ... | grep -E "evictions|curr_items|bytes"

Cleartext protocol or non-binary client cannot connect

The image enforces the binary protocol with -B binary in /etc/memcached.conf. SASL works only on the binary protocol, so the ASCII protocol is rejected by design.

Configure your client library to use the binary protocol: binary=True in pylibmc, OPT_BINARY_PROTOCOL in PHP Memcached, and so on.

To rotate the SASL password, regenerate the sasldb entry and update the credentials file:

NEW_PASS=$(openssl rand -hex 16)
echo -n "${NEW_PASS}" | sudo saslpasswd2 -p -a memcached -f /etc/sasl2/memcached-sasldb2 sac
sudo chown memcache:memcache /etc/sasl2/memcached-sasldb2
sudo chmod 0640 /etc/sasl2/memcached-sasldb2
sudo systemctl restart memcached
sudo sed -i "s/^MEMCACHED_PASSWORD=.*/MEMCACHED_PASSWORD=${NEW_PASS}/" /stage/scripts/memcached-credentials.log echo "Rotated. New password stored in /stage/scripts/memcached-credentials.log"

After you rotate the password, update every client configuration that holds the old one.

• Rotate the SASL password immediately after deployment. Step 12 shows how.
• Restrict the NSG so port 11211 is reachable only from your application VMs and admin networks. Never expose it to the public internet.
• Enable TLS for any cross-VM connection. Cleartext Memcached exposes both the SASL password (PLAIN mechanism) and the cached data.
• Size the cache correctly with -m, so that eviction does not push heavy load onto your application's database fallback.
• Treat Memcached as a cache. It is volatile by design and all keys disappear on restart. Never use it as a primary data store.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot.
• Monitor evictions, curr_items, bytes, cmd_get and cmd_set with memcstat. Sudden swings point to application-level cache misses or a DDoS.
• Add a second Memcached node for warm failover. Clients with consistent hashing (pylibmc, dalli) handle multi-node clusters natively.

Memcached is released under the BSD-3-Clause license, which is permissive and allows commercial use and modification.

SecureAnyCloud provides commercial support for this image, separately from the upstream project.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, with a 24 hour response SLA

Deploy on Azure

Launch Memcached 1.6 on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Memcached 1.6 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com