Welcome to the Hindi Tutor QA. Create an account or login for asking a question and writing an answer.
Aditya in Web Hosting
How To Install and Secure Memcached on Ubuntu 20.04? Memory object caching systems like Memcached can optimize back-end database performance by temporarily storing information in memory, retaining frequently or recently requested records.

1 Answer

+1 vote

Installing Memcached from the Official Repositories

If you don’t already have Memcached installed on your server, you can install it from the official Ubuntu repositories. First, make sure that your local package index is updated:

sudo apt update

Next, install the official package as follows:

sudo apt install memcached

We can also install libmemcached-tools, a library that provides several tools to work with your Memcached server:

sudo apt install libmemcached-tools

Memcached should now be installed as a service on your server, along with tools that will allow you to test its connectivity. We can now move on to securing its configuration settings.

Securing Memcached Configuration Settings

To ensure that our Memcached instance is listening on the local interface, we will check the default setting in the configuration file located at /etc/memcached.conf. The current version of Memcached that ships with Ubuntu and Debian has the -l parameter set to the local interface, which prevents denial of service attacks from the network. We can inspect this setting to ensure that it is set correctly.

You can open /etc/memcached.conf with nano:

sudo nano /etc/memcached.conf

To inspect the interface setting, find the following line in the file:



If you see the default setting of -l then there is no need to modify this line. If you do modify this setting to be more open, then it is also a good idea to also disable UDP, as it is more likely to be exploited in denial of service attacks. To disable UDP (while leaving TCP unaffected), add the following option to the bottom of this file:


-U 0

Save and close the file when you are done.

Restart your Memcached service to apply your changes:

sudo systemctl restart memcached

Verify that Memcached is currently bound to the local interface and listening only for TCP connections by typing:

sudo netstat -plunt

You should see the following output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0* LISTEN 2279/memcached

This confirms that memcached is bound to the address using only TCP.

Adding Authorized Users

To add authenticated users to your Memcached service, it is possible to use Simple Authentication and Security Layer (SASL), a framework that de-couples authentication procedures from application protocols. We will enable SASL within our Memcached configuration file and then move on to adding a user with authentication credentials.

Configuring SASL Support

We can first test the connectivity of our Memcached instance with the memcstat command. This will help us establish that SASL and user authentication are enabled after we make changes to our configuration files.

To check that Memcached is up and running, type the following:

memcstat --servers=""

You should see output like the following:

Server: (11211)
pid: 2279
uptime: 65
time: 1546620611
version: 1.5.6

Now we can move on to enabling SASL. First, we will add the -S parameter to /etc/memcached.conf. Open the file again:

sudo nano /etc/memcached.conf

At the bottom of the file, add the following: /etc/memcached.conf


Next, find and uncomment the -vv option, which will provide verbose output to /var/log/memcached. The uncommented line should look like this: /etc/memcached.conf


Save and close the file.

Restart the Memcached service:

sudo systemctl restart memcached

Next, we can take a look at the logs to be sure that SASL support has been enabled:

sudo journalctl -u memcached

You should see the following line, indicating that SASL support has been initialized: Output:

Jan 04 16:51:12 memcached systemd-memcached-wrapper[2310]: Initialized SASL

We can check the connectivity again, but because SASL has been initialized, this command should fail without authentication:

memcstat --servers=""

This command should not produce output. We can type the following to check its status:

echo $?

$? will always return the exit code of the last command that exited. Typically, anything besides 0 indicates process failure. In this case, we should see an exit status of 1, which tells us that the memcstat command failed.

Adding an Authenticated User

Now we can download sasl2-bin, a package that contains administrative programs for the SASL user database. This will allow us to create our authenticated user:

sudo apt install sasl2-bin

Next, we will create the directory and file that Memcached will check for its SASL configuration settings:

sudo mkdir /etc/sasl2
sudo nano /etc/sasl2/memcached.conf

Add the following to the SASL configuration file: /etc/sasl2/memcached.conf

mech_list: plain
log_level: 5
sasldb_path: /etc/sasl2/memcached-sasldb2

In addition to specifying our logging level, we will set mech_list to plain, which tells Memcached that it should use its own password file and verify a plaintext password. We will also specify the path to the user database file that we will create next. Save and close the file when you are finished.

Now we will create a SASL database with our user credentials. We will use the saslpasswd2 command to make a new entry for our user in our database using the -c option. Our user will be sammy here, but you can replace this name with your own user. Using the -f option, we will specify the path to our database, which will be the path we set in /etc/sasl2/memcached.conf:

sudo saslpasswd2 -a memcached -c -f /etc/sasl2/memcached-sasldb2 sammy

You will be asked to type and re-verify a password of your choosing.

Finally, we will give the memcache user ownership over the SASL database:

sudo chown memcache:memcache /etc/sasl2/memcached-sasldb2 

Restart the Memcached service:

sudo systemctl restart memcached

Running memcstat again will confirm whether or not our authentication process worked. This time we will run it with our authentication credentials:

memcstat --servers="" --username=sammy --password=your_password

You should see output like the following: Output:

Server: (11211)
pid: 2772
uptime: 31
time: 1546621072
version: 1.5.6 Ubuntu

Our Memcached service is now successfully running with SASL support and user authentication.

Related questions