Memcached Hardening for DevSecOps

Table of contents

1. Disable UDP listener
2. Enable SASL authentication
3. Limit incoming traffic to known IP addresses
4. Limit maximum memory usage
5. Run as non-root user
6. Enable logging
7. Upgrade to the latest version
8. Disable unused flags

List of some best practices to harden Memcached for DevSecOps

Disable UDP listener

sed -i 's/^-U 0/#-U 0/g' /etc/sysconfig/memcached

Enable SASL authentication

sed -i 's/^#-S/-S/g' /etc/sysconfig/memcached
yum install cyrus-sasl-plain
htpasswd -c /etc/sasl2/memcached-sasldb username
chmod 600 /etc/sasl2/memcached-sasldb

Limit incoming traffic to known IP addresses

iptables -A INPUT -p tcp --dport 11211 -s 192.168.1.100 -j ACCEPT

Limit maximum memory usage

echo 'CACHESIZE="128"' > /etc/sysconfig/memcached

Run as non-root user

sed -i 's/^-u root/-u memcached/g' /etc/sysconfig/memcached

Enable logging

sed -i 's/^logfile/#logfile/g' /etc/sysconfig/memcached
mkdir /var/log/memcached
touch /var/log/memcached/memcached.log
chown memcached:memcached /var/log/memcached/memcached.log
sed -i 's/^#logfile/LOGFILE="\/var\/log\/memcached\/memcached.log"/g' /etc/sysconfig/memcached

Upgrade to the latest version

yum update memcached

Disable unused flags

sed -i 's/^-I 1m/#-I 1m/g' /etc/sysconfig/memcached
sed -i 's/^-a 0765/#-a 0765/g' /etc/sysconfig/memcached