Secure Memcached on Directadmin server

CloudFlare reported in their blog-post about a big increase in an obscure amplification attack vector - using the memcached protocol, coming from UDP port 11211. Here we will provide details on how to protect your server with Directadmin.

What you have?

By default memcached on a CentOS server is accepting connections from all IPs to port 11211 both TCP and UDP:

# netstat -nlp | grep memcached
tcp        0      0 0.0.0.0:11211               0.0.0.0:*                   LISTEN      11287/memcached
tcp        0      0 :::11211                    :::*                        LISTEN      11287/memcached
udp        0      0 0.0.0.0:11211               0.0.0.0:*                               11287/memcached
udp        0      0 :::11211                    :::*                                    11287/memcached

What to do?

First of all make sure you've a firewall which is filtering incoming and outgoing connections to port 11211.

Then update memcached options in the file /etc/sysconfig/memcached. Originally it looks like:

PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS=""

So we need to update OPTIONS to the following view:

OPTIONS=" -l 127.0.0.1 -U 0"

Now restart memcached and check results:

[root@server ~]#  netstat -nlp | grep memc
tcp        0      0 127.0.0.1:11211             0.0.0.0:*                   LISTEN      11871/memcached
[root@server ~]# 

That's it.