Memcached Hardened · Releases

Memcached Hardened v2.1 — Port and credential control from the CLI itself

Mon, 24 Aug 2026 00:00:00 +0000

v2.0 shipped with the `memcached` module 1.0.0, which knew how to inspect and size things but not how to *change* what the buyer touches on day one: the port and the password. It was done by hand with `ufw` and `saslpasswd2`, and getting it wrong was easy. This version bakes in module 1.1.0, which solves it with three commands.

New: `imaxe memcached open-port [--cidr ]` and `close-port` govern port 11211 in the host firewall. `open-port` removes previous rules for the same port before adding its own, so that opening "only to my network" doesn't also leave the global rule open to everyone. Both warn that remote access is ultimately decided by the security group, which the CLI does not touch.
New: `imaxe memcached set-password (--random | | --stdin)` changes the product user's credential without touching the rest of the SASL users or restarting the service (a restart would flush the cache). Unlike `users rotate`, it does not generate a password by default: you have to ask for it, so a half-typed command doesn't leave the buyer without the credential they were using.
Improved: `imaxe memcached status` also reports the port's state in `ufw`, with the same warning about the security group.
Improved: `AllowTcpForwarding` goes from `local` to `yes`. The remote-access path we document — the same one Bitnami recommends — is the SSH tunnel against 11211, and with this it works without the buyer having to edit `sshd_config`. It is a deliberate exception to the hardened base, justified because the alternative is worse: they'd end up opening 11211 in the security group for lack of a working tunnel. It doesn't change the Lynis index: the test auditing the `sshd_config` options (SSH-7408) is among those the image skips.

Memcached Hardened v2.0 — Ubuntu 26.04 base and Lynis 100/100

Wed, 19 Aug 2026 00:00:00 +0000

The AMI is rebuilt on Ubuntu 26.04 LTS (resolute), arm64, and the Lynis audit reaches the maximum index.

Improved: Base updated from Ubuntu 24.04 LTS to 26.04 LTS (resolute); Memcached 1.6 still comes from the official Ubuntu packages. Published in the same 32 AWS regions.
Security: Lynis audit 100/100 (241 tests, 0 warnings, 0 suggestions): the open findings from v1.0 are resolved. Full base hardening unchanged: SASL + TLS out of the box, ufw, hardened SSH, AppArmor, auditd, AIDE, rkhunter, ClamAV and fail2ban.

Memcached Hardened v1.0 — Initial release

Fri, 14 Aug 2026 00:00:00 +0000

First public version on AWS Marketplace, on Ubuntu 24.04 LTS arm64.

New: AMI published in 32 AWS regions, arm64 (Graviton) architecture, with Memcached 1.6 from the Ubuntu packages.
Security: SASL enabled out of the box with a unique per-instance credential and mandatory TLS (min. 1.2) on the network port; UDP disabled. Full base hardening: ufw, hardened SSH, AppArmor, auditd, AIDE, rkhunter, ClamAV and fail2ban. Lynis audit 94/100.
New: Automatic cache tuning on every boot (`imaxe memcached optimize`) and the `imaxe` tool with 13 modules baked into the image.