{"id":1698,"date":"2014-12-16T19:19:03","date_gmt":"2014-12-16T19:19:02","guid":{"rendered":"https:\/\/www.couchbase.com\/blog\/?p=1698"},"modified":"2023-11-28T11:22:23","modified_gmt":"2023-11-28T19:22:23","slug":"memcached-security-best-practices","status":"publish","type":"post","link":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/","title":{"rendered":"Memcached Security Best Practices"},"content":{"rendered":"

Memcached<\/a> security is a hot topic since the sensepost guys released go-derper\u00a0at blackhat.<\/p>\n

The presentation was pretty good and informative, but it seems like the hype around it has left a bunch of people confused. Although much of this was covered in the presentation, it needs to be restated as much as possible.<\/p>\n

First and Always, Firewall<\/h3>\n

This is really part of the sysadmin placement test and has nothing to do with memcached<\/a> in particular, but I\u2019m going to go ahead and mention it anyway.<\/p>\n

You always start by firewalling everything<\/em> and then allowing only stuff you need to pass through to the places you need it to pass through.<\/p>\n

I won\u2019t teach you how to use your firewall, but start with the setting that disables all connectivity to your box.<\/p>\n

If you\u2019re running a web server, allow connections to port 443<\/code>. If you also want non-ssl connections, allow port 80<\/code>. If that\u2019s the only service you\u2019re providing, then your firewalling is now complete!<\/p>\n

I\u2019d like to note that Amazon EC2<\/span><\/u><\/a> does this by default<\/em>, yet enough firewalls are misconfigured that they felt the need to send out a form mail to many of their users to let them know that they \u201chave at least one security group that allows the whole internet to have access to the port most commonly used by memcached<\/a> (11211)\u201d.<\/p>\n

Check Your Bindings<\/h3>\n

If your application only runs on one server (with the app and memcached<\/a> on the same box), you can bind it to localhost by adding<\/p>\n

\n
-l 127.0.0.1<\/div>\n<\/div>\n

to the memcached<\/a> flags. Now even though you\u2019ve firewalled access to memcached<\/a>, you have to be on<\/em> the machine to even contact the cache when someone breaks your firewall settings.<\/p>\n

If You Need It, Use SASL<\/h3>\n

The latest versions of memcached<\/a> encryption supports SASL<\/span><\/u><\/a> authentication.<\/p>\n

Although you\u2019ve already firewalled your memcached<\/a> services off, you can require clients to perform strong authentication before using the service.<\/p>\n

Please, Please<\/em> Do Not Run as Root<\/h3>\n

Under no circumstances should you attempt to run memcached<\/a> as root; it does not<\/em>\u00a0<\/span>want to run as root. It tries hard to prevent this. Yet many people have a \u201cworkaround\u201d that allows memcached <\/a>to start as root (which I will not repeat) just for the sake of making their infrastructure less secure.<\/p>\n

If someone somehow bypasses the firewall you have set up preventing access to memcached<\/a> and somehow manages to find a security hole in memcached<\/a> allowing code execution, do you really<\/em> want to just hand over root access?<\/p>\n

There are no such known issues, but we don\u2019t audit the code to ensure it\u2019s safe to run as root. That\u2019s OK, though, because no responsible sysadmin would ever run a service as root without very strong justification, and probably a lot of work in creating a jailed environment.<\/p>\n

Check Your Firewall Settings<\/h3>\n

Look, I\u2019m not doubting that you know how to set up your firewall, but just bear with me.<\/p>\n

\"Knowing\"<\/a><\/div>\n

Grab nmap<\/span><\/u><\/a> or similar. Run a full port scan across your box \u2013 one from a trusted system, one from a semi-trusted system, and one from a completely untrusted system.<\/p>\n

If there\u2019s any response for any service you cannot justify running, you now know about it and can fix it.<\/p>\n

That\u2019s not just memcached<\/a> \u2013 that\u2019s gearman, beanstalkd, snmpd, a mail server, a DNS server, LDAP server, etc.<\/p>\n

For any service you do<\/em> have running and publicly available, make sure you completely<\/em> understand the security implications of running this service.<\/p>\n

Do not be embarrassed to ask if you don\u2019t understand everything. It\u2019s a lot better than being an example in a presentation at the next black hat because you\u2019re running a service you didn\u2019t intend to and you leaked important information.<\/p>\n","protected":false},"excerpt":{"rendered":"

Memcached security is a hot topic since the sensepost guys released go-derper\u00a0at blackhat. The presentation was pretty good and informative, but it seems like the hype around it has left a bunch of people confused. Although much of this was […]<\/p>\n","protected":false},"author":34,"featured_media":13873,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"ppma_author":[8992],"class_list":["post-1698","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"yoast_head":"\nMemcached Security Best Practices: 5 to Keep an Eye On<\/title>\n<meta name=\"description\" content=\"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Memcached Security Best Practices\" \/>\n<meta property=\"og:description\" content=\"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\" \/>\n<meta property=\"og:site_name\" content=\"The Couchbase Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-12-16T19:19:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-11-28T19:22:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dustin.github.com\/images\/thebattle.png\" \/>\n<meta name=\"author\" content=\"Dustin Sallings, Chief Architect, Couchbase\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dustin Sallings, Chief Architect, Couchbase\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\"},\"author\":{\"name\":\"Dustin Sallings, Chief Architect, Couchbase\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/e68b6f4489072ef4a84f60bc437c07d0\"},\"headline\":\"Memcached Security Best Practices\",\"datePublished\":\"2014-12-16T19:19:02+00:00\",\"dateModified\":\"2023-11-28T19:22:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\"},\"wordCount\":637,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\",\"name\":\"Memcached Security Best Practices: 5 to Keep an Eye On\",\"isPartOf\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png\",\"datePublished\":\"2014-12-16T19:19:02+00:00\",\"dateModified\":\"2023-11-28T19:22:23+00:00\",\"description\":\"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png\",\"width\":1800,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.couchbase.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Memcached Security Best Practices\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#website\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"name\":\"The Couchbase Blog\",\"description\":\"Couchbase, the NoSQL Database\",\"publisher\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#organization\",\"name\":\"The Couchbase Blog\",\"url\":\"https:\/\/www.couchbase.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"contentUrl\":\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png\",\"width\":218,\"height\":34,\"caption\":\"The Couchbase Blog\"},\"image\":{\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/e68b6f4489072ef4a84f60bc437c07d0\",\"name\":\"Dustin Sallings, Chief Architect, Couchbase\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/c5bddc8d7dab8b5c9121282556b0dbff\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/61704e29c6b19851f45c023b2f456b2a0c80ba03ae65e957e39080a0d15065e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/61704e29c6b19851f45c023b2f456b2a0c80ba03ae65e957e39080a0d15065e5?s=96&d=mm&r=g\",\"caption\":\"Dustin Sallings, Chief Architect, Couchbase\"},\"description\":\"Dustin Sallings is a Chief Architect at Couchbase. Dustin is an Author of spymemcached and core contributor to Couchbase and Memcached projects.\",\"url\":\"https:\/\/www.couchbase.com\/blog\/author\/dustin-sallings\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Memcached Security Best Practices: 5 to Keep an Eye On","description":"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/","og_locale":"en_US","og_type":"article","og_title":"Memcached Security Best Practices","og_description":"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.","og_url":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/","og_site_name":"The Couchbase Blog","article_published_time":"2014-12-16T19:19:02+00:00","article_modified_time":"2023-11-28T19:22:23+00:00","og_image":[{"url":"https:\/\/dustin.github.com\/images\/thebattle.png","type":"","width":"","height":""}],"author":"Dustin Sallings, Chief Architect, Couchbase","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Dustin Sallings, Chief Architect, Couchbase","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#article","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/"},"author":{"name":"Dustin Sallings, Chief Architect, Couchbase","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/e68b6f4489072ef4a84f60bc437c07d0"},"headline":"Memcached Security Best Practices","datePublished":"2014-12-16T19:19:02+00:00","dateModified":"2023-11-28T19:22:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/"},"wordCount":637,"commentCount":0,"publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/","url":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/","name":"Memcached Security Best Practices: 5 to Keep an Eye On","isPartOf":{"@id":"https:\/\/www.couchbase.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage"},"thumbnailUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png","datePublished":"2014-12-16T19:19:02+00:00","dateModified":"2023-11-28T19:22:23+00:00","description":"This Couchbase blog includes 5 best practices in Memcached Security, including firewall tips, binding checks, SASL usage, and whether to Run as Root.","breadcrumb":{"@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#primaryimage","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/sites\/1\/2022\/11\/couchbase-nosql-dbaas.png","width":1800,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.couchbase.com\/blog\/memcached-security-best-practices\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.couchbase.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Memcached Security Best Practices"}]},{"@type":"WebSite","@id":"https:\/\/www.couchbase.com\/blog\/#website","url":"https:\/\/www.couchbase.com\/blog\/","name":"The Couchbase Blog","description":"Couchbase, the NoSQL Database","publisher":{"@id":"https:\/\/www.couchbase.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.couchbase.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.couchbase.com\/blog\/#organization","name":"The Couchbase Blog","url":"https:\/\/www.couchbase.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","contentUrl":"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2023\/04\/admin-logo.png","width":218,"height":34,"caption":"The Couchbase Blog"},"image":{"@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/e68b6f4489072ef4a84f60bc437c07d0","name":"Dustin Sallings, Chief Architect, Couchbase","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.couchbase.com\/blog\/#\/schema\/person\/image\/c5bddc8d7dab8b5c9121282556b0dbff","url":"https:\/\/secure.gravatar.com\/avatar\/61704e29c6b19851f45c023b2f456b2a0c80ba03ae65e957e39080a0d15065e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/61704e29c6b19851f45c023b2f456b2a0c80ba03ae65e957e39080a0d15065e5?s=96&d=mm&r=g","caption":"Dustin Sallings, Chief Architect, Couchbase"},"description":"Dustin Sallings is a Chief Architect at Couchbase. Dustin is an Author of spymemcached and core contributor to Couchbase and Memcached projects.","url":"https:\/\/www.couchbase.com\/blog\/author\/dustin-sallings\/"}]}},"authors":[{"term_id":8992,"user_id":34,"is_guest":0,"slug":"dustin-sallings","display_name":"Dustin Sallings, Chief Architect, Couchbase","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/61704e29c6b19851f45c023b2f456b2a0c80ba03ae65e957e39080a0d15065e5?s=96&d=mm&r=g","author_category":"","last_name":"Sallings","first_name":"Dustin","job_title":"","user_url":"","description":"Dustin Sallings is a Chief Architect at Couchbase. Dustin is an Author of spymemcached and core contributor to Couchbase and <a href=\"https:\/\/developer.couchbase.com\/documentation\/server\/3.x\/developer\/dev-guide-3.0\/memcached.html#projects\">Memcached projects.<\/a>"}],"_links":{"self":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/1698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/comments?post=1698"}],"version-history":[{"count":0,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/posts\/1698\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media\/13873"}],"wp:attachment":[{"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/media?parent=1698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/categories?post=1698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/tags?post=1698"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.couchbase.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=1698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}