Memcached - Hardened Self-Hosted In-Memory Cache (SASL Auth)

What is Memcached

Memcached is a high-performance, distributed in-memory object caching system, implemented as a single multithreaded C daemon built on libevent. It stores arbitrary key-value pairs in RAM to take load off databases and APIs, with a slab allocator, LRU eviction, per-key TTL expiry, atomic increment/decrement and compare-and-swap, and text, binary and meta protocols. Applications shard transparently across nodes using consistent hashing in the client, with mature client libraries for PHP, Python, Java, Node.js, Go, Ruby and most other languages. Memcached is in-memory only with no persistence by design - the cache is rebuilt by the application after a restart. BSD-3-Clause license, no vendor lock-in.

Why self-host Memcached

Running Memcached on a VM you control keeps your cached data - which often mirrors session tokens, query results and user records - inside your own tenant rather than a third-party managed service. Self-hosting suits teams with data residency requirements, organisations operating under GDPR or ISO 27001, and any architecture where a low-latency cache must sit on a private network next to its application tier with no per-request fees.

What this VM image adds

Security hardening:

• SASL authentication required - a unique random credential is generated per instance at first boot, never a default or empty password, and stored in /root/memcached-credentials.txt (mode 0600)
• Bound to the private interface and loopback only - never 0.0.0.0, so the cache is not reachable from the public internet
• UDP disabled (-U 0) - closes the well-known Memcached DDoS amplification vector
• Memory cap sized to the instance automatically at first boot
• UFW firewall - SSH on 22 only; the cache port 11211 is reached on the private interface and governed by your NSG; Azure IMDS and WireServer egress pre-configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with Memcached pinned by version, PURL, BSD-3-Clause license, supplier, and SHA-256 hash of the binary
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• SASL credentials file at /root/memcached-credentials.txt (mode 0600) with the cache username and password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/memcached-credentials.txt for the SASL username and password
3. Open NSG: TCP 11211 from your trusted app-tier sources only (never 0.0.0.0/0), TCP 22 from your management IPs only
4. Connect from an app server in the same VNet using a SASL-capable client on the private IP and port 11211
5. Python example (python-binary-memcached): c = bmemcached.Client(("<PRIVATE_IP>:11211",), "<username>", "<password>")

Memcached is a VNet-internal cache: it is bound to the private interface only, requires SASL authentication, and has UDP disabled. The cache is in-memory only and is empty after a reboot by design.