CIS Memcached Benchmark

This recommendation verifies that Memcached is running the latest stable version on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Memcached version
memcached -h | head -1
dpkg -l memcached 2>/dev/null || rpm -q memcached 2>/dev/null

# Update Memcached to latest stable
apt-get update && apt-get install --only-upgrade memcached
# Or compile from source:
wget https://memcached.org/latest
tar xzf memcached-*.tar.gz && cd memcached-*
./configure && make && make install

This recommendation verifies that Memcached runs as a dedicated non-root user on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Memcached runs as dedicated user
ps -eo user,pid,comm | grep memcached
grep -E '^-u|^USER' /etc/memcached.conf 2>/dev/null

# Run as dedicated non-root user
# In /etc/memcached.conf:
# -u memcached
useradd -r -s /usr/sbin/nologin memcached
# Or in systemd unit:
# User=memcached
# Group=memcached

This recommendation verifies that Memcached binds to localhost or Unix socket only on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check listening interface
grep -E '^-l|^-s' /etc/memcached.conf
ss -tlnp | grep memcached

# Bind to localhost or Unix socket only
# In /etc/memcached.conf:
# -l 127.0.0.1
# Or use Unix socket:
# -s /var/run/memcached/memcached.sock
# -a 0770
# Disable UDP:
# -U 0

This recommendation verifies that UDP protocol is disabled on the Memcached distributed caching system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Memcached distributed caching system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check if UDP is disabled
grep '^-U' /etc/memcached.conf
ss -ulnp | grep 11211

# Disable UDP protocol
# In /etc/memcached.conf:
# -U 0
# This prevents UDP amplification attacks
systemctl restart memcached

This recommendation verifies that SASL authentication is enabled on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SASL authentication
grep -E 'enable-sasl|SASL' /etc/memcached.conf
memcached -h | grep -i sasl

# Enable SASL authentication
# In /etc/memcached.conf:
# -S
# Create SASL credentials:
saslpasswd2 -a memcached -c -f /etc/sasl2/memcached-sasldb2 appuser
# Create /etc/sasl2/memcached.conf:
# mech_list: plain
# log_level: 5
# sasldb_path: /etc/sasl2/memcached-sasldb2

This recommendation verifies that TLS encryption is configured on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration
grep -E 'enable-ssl|ssl_chain_cert|ssl_key' /etc/memcached.conf

# Enable TLS encryption
# In /etc/memcached.conf:
# --enable-ssl
# -o ssl_chain_cert=/etc/memcached/ssl/cert.pem
# -o ssl_key=/etc/memcached/ssl/key.pem
# -o ssl_ca_cert=/etc/memcached/ssl/ca.pem
# -o ssl_verify_mode=2
# -o ssl_min_version=tlsv1.2

This recommendation verifies that verbose logging to syslog is enabled on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration
grep -E '^-v|^-vv|syslog' /etc/memcached.conf

# Configure verbose logging
# In /etc/memcached.conf:
# -v (or -vv for more detail)
# Log to syslog:
# -o syslog
# Configure logrotate for memcached logs

This recommendation verifies that cache statistics are monitored on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check stats output
echo 'stats' | nc localhost 11211 | head -20

# Monitor Memcached statistics
# Check hit ratio:
echo 'stats' | nc localhost 11211 | grep -E 'get_hits|get_misses|evictions|curr_connections'
# Alert on high eviction rates
# Monitor via collectd, telegraf, or prometheus exporter

This recommendation verifies that memory limits are appropriately configured on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check memory limits
grep '^-m' /etc/memcached.conf
echo 'stats' | nc localhost 11211 | grep 'limit_maxbytes'

# Configure appropriate memory limits
# In /etc/memcached.conf:
# -m 512  (512 MB)
# Set based on available system RAM
# Also limit max item size:
# -I 1m  (default 1MB max item)

This recommendation verifies that connection and thread limits are set on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check connection limits
grep '^-c' /etc/memcached.conf
echo 'stats' | nc localhost 11211 | grep 'max_connections'

# Configure connection limits
# In /etc/memcached.conf:
# -c 1024  (max simultaneous connections)
# -t 4     (number of threads)
# -R 20    (max requests per event)
# -b 1024  (backlog queue limit)

This recommendation verifies that firewall rules restrict access to Memcached port on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if Memcached is firewalled
iptables -L -n | grep 11211
ufw status | grep 11211 2>/dev/null

# Firewall Memcached port
ufw deny 11211/tcp
ufw deny 11211/udp
# Or with iptables:
iptables -A INPUT -p tcp --dport 11211 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 11211 -j DROP

This setting ensures that destructive commands are restricted via authentication on the Memcached distributed caching system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Memcached distributed caching system is essential for defense in depth.

# Check for dangerous flush commands
echo 'stats detail dump' | nc localhost 11211 | head -5

# Restrict flush_all in production
# Use SASL auth to prevent unauthorized flush
# Monitor for flush_all commands in logs
# Consider disabling flush_all via:
# -o no_lru_crawler,no_lru_maintainer (limits maintenance commands)
# Use separate instances for different applications

This setting ensures that configuration file permissions are restricted on the Memcached distributed caching system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Memcached distributed caching system is essential for defense in depth.

# Check configuration file permissions
stat -c '%a %U %G' /etc/memcached.conf

# Restrict configuration permissions
chmod 640 /etc/memcached.conf
chown root:memcached /etc/memcached.conf
chmod 600 /etc/sasl2/memcached-sasldb2 2>/dev/null

This recommendation verifies that regular version updates are scheduled on the Memcached distributed caching system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Memcached distributed caching system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if Memcached is current
memcached -h | head -1
curl -s https://api.github.com/repos/memcached/memcached/releases/latest | grep tag_name 2>/dev/null

# Schedule regular updates
apt-get update && apt-get install --only-upgrade memcached
systemctl restart memcached
# Verify stats after restart:
echo 'version' | nc localhost 11211