Memcached Hardened

Description #

Imaxe Hardened Memcached is a hardened, production-ready Memcached AMI, designed as a drop-in replacement for “Memcached packaged by Bitnami”. It installs Memcached from the standard Ubuntu packages — apt, systemd and FHS paths, with no monolithic trees under /opt and no proprietary supervisors — on top of the imaxe hardened base.

Two out-of-the-box security differences from the Bitnami product: SASL authentication comes enabled (not disabled), with a unique per-instance password, and network traffic is encrypted with TLS, with a certificate also generated on each instance. Since memcached’s only SASL mechanism is PLAIN, without TLS the password would travel in the clear — here that cannot happen.

The rest is the imaxe hardened base: default-deny firewall, hardened SSH, AppArmor in enforce mode, auditing with auditd, file integrity with AIDE, rootkit detection with rkhunter, ClamAV antivirus and brute-force protection with fail2ban. All of it verified on every release with a Lynis audit whose full report you can read below.

Quick start: up and running in 5 minutes #

Everything you need to go from zero to a hardened cache in production.

If you’d rather do it by hand, the long way is five steps:

Features #

Everything the image includes, grouped into what is standard and what is ours.

General

• Memcached 1.6 from the official Ubuntu 26.04 LTS packages (resolute, arm64), managed with systemd — no trees under /opt, no proprietary scripts.
• Ubuntu base updated on every build, with automatic security patches (unattended-upgrades) enabled.
• ufw firewall in default-deny: only 22 (SSH) and 11211 (memcached) allowed locally; the Marketplace security group only exposes 22.
• Hardened SSH: no root, no passwords, public key only, modern cryptography (ed25519, chacha20-poly1305, post-quantum kex sntrup761x25519).
• AppArmor with extra profiles installed and all of them in enforce mode.
• Kernel hardened via sysctl, mounts with noexec,nosuid,nodev, /proc with hidepid=2.
• Full auditing with auditd, integrity with AIDE and debsums, anti-malware with rkhunter and ClamAV, fail2ban integrated with ufw.

Special

• SASL mandatory out of the box: user memcached with a unique per-instance password (the instance-id on first boot), dumped to the EC2 system console — where anyone coming from Bitnami looks for it. Nothing is baked into the AMI: every instance gets a fresh credential.
• TLS built into port 11211 (minimum TLS 1.2): a self-signed certificate issued on each instance — EC P-256 key, instance-id as CN, the instance’s IPs and names as SANs — before the service starts. You can install your own.
• Port 11212 in the clear on loopback only, for the system tools (memcstat and friends don’t speak TLS). It still requires SASL and is not reachable from outside.
• UDP affirmatively disabled (-U 0): memcached’s UDP protocol is the classic DDoS amplification vector.
• Automatic tuning on every boot: imaxe memcached optimize recomputes cache memory, connections and threads from the real CPU and RAM — stop the instance, change the type, boot, and the cache resizes itself.
• SASL user management with no restarts: imaxe memcached users add/rotate/delete — the SASL database is read on every authentication and the cache is not flushed.
• imaxe tool included: a CLI to operate the service, the credentials, the certificate and all the hardening without editing files by hand.
• Lynis audit on every release, with the full report published on this page.

imaxe modules

Modules of the imaxe tool baked into this AMI, with their documentation:

Sizing and costs #

The AMI runs on any AWS arm64 (Graviton) instance and sizes itself: on every boot, imaxe memcached optimize assigns 60% of the usable RAM to the cache (after reserving 512 MB for the OS and the agents) and derives threads and connections from the instance size. Pick the type by the cache you need: more RAM = more cache, with no configuration changes. The recommended starting instance is t4g.medium, which is also where this image’s builds and tests run.

Lynis reports #

Result of the Lynis hardening audit for each published version: hardening index, warnings and suggestions, with the full line-by-line report.

Available versions #

Versions of this AMI published on AWS Marketplace:

Lifecycle

v2.0 is the current version, active and maintained: Ubuntu security patches reach the instances on their own via unattended-upgrades, and we publish new AMI versions on the Marketplace on a regular cadence, each with its own Lynis audit. When a new version ships it will appear in this table and in the changelog.

How to launch the AMI #

The AMI follows the standard EC2 launch flow on arm64 (Graviton) instances. The Marketplace security group only exposes one port:

Once it’s running — SSH: user ubuntu with the keypair chosen at launch. There is no accessible root user and no password authentication. Cache credential: SASL user memcached with the instance-id as the initial password, visible in the EC2 system console or over SSH:

ssh -i mi-keypair.pem ubuntu@<ip-de-la-instancia>
sudo imaxe memcached credentials      # usuario, password y puerto
imaxe memcached tls show              # huella del certificado de esta instancia

memcstat --binary --servers=127.0.0.1:11212 --username=memcached \
         --password=$(sudo imaxe memcached credentials --show-password --json | jq -r .password)

sudo install -m 0644 -o root -g root mi.crt /etc/memcached/tls/server.crt
sudo install -m 0640 -o root -g memcache mi.key /etc/memcached/tls/server.key
sudo rm -f /etc/memcached/tls/.generated-for   # sin testigo, el módulo no lo toca
sudo systemctl restart memcached

Backups and updates #

• Automatic patches: unattended-upgrades applies Ubuntu security updates daily, with no intervention.
• Antivirus signatures: freshclam updates the ClamAV database 24 times a day.
• New AMIs: we publish updated versions of the image on the Marketplace on a regular cadence; every version passes its own Lynis audit before being published.
• Backups: there are none, by design. Memcached is a volatile cache: its contents are lost on every restart and it must never hold the only copy of any data. There is nothing to back up or restore.

Troubleshooting #

The issues behind almost every ticket, with their usual cause and the fix.

Frequently asked questions #

Changelog #

AMI history. Dates are the publication date of each version on AWS Marketplace.