Description:
Security Groups act as virtual firewalls that control inbound and outbound network traffic for cloud instances. Memcached uses TCP and UDP port 11211 by default for client connections. Allowing unrestricted inbound access to this port (for example, 0.0.0.0/0 or::/0) exposes the Memcached service to the public internet and increases the risk of unauthorized access. Access to port 11211 should be restricted to trusted IP addresses or private network ranges only.
Rationale:
Memcached is designed to be accessed only by trusted applications within a private network. Exposing port 11211 to the public internet may allow unauthorized users to access cached data or misuse the service. Restricting inbound access reduces the attack surface and improves the security of cloud instances.
Impact:
Applications outside the allowed IP addresses or network ranges will not be able to connect to the Memcached service.
Ensure that all trusted application servers and internal networks are allowed before restricting access.
Verify application connectivity after updating the Security Group rules.
Default Value:
By default, Utho allows administrators to configure Security Group rules. It is the administrator's responsibility to ensure that unrestricted inbound access to TCP/UDP port 11211 is not configured.
Pre-requisites:
A Utho account with permission to manage Security Groups.
Access to the Utho Console.
Permission to modify Security Group rules.
Knowledge of the trusted IP addresses or private network ranges that require access to the Memcached service.
Remediation
Test Plan:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the cloud instance running the Memcached service.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Review the rules configured for TCP or UDP port 11211.
Verify that the Source is not configured as 0.0.0.0/0 or ::/0.
Confirm that access to port 11211 is restricted to trusted IP addresses or private network ranges.
If any Incoming Rule allows unrestricted access to port 11211, follow the Implementation Steps to remediate the issue.
Using the Utho API
Retrieve the Security Group configuration.
curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that no Incoming Rule allows TCP or UDP port 11211 from 0.0.0.0/0 or ::/0.
Implementation Steps:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the cloud instance running the Memcached service.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Locate the rule that allows TCP traffic on port 11211 from an unrestricted source (such as 0.0.0.0/0 or ::/0).
Delete the unrestricted Incoming Rule.
Under Add Incoming Rule, configure the following values:
Service: All TCP
Protocol: TCP
Port: 11211
Sources: Enter only the trusted IP address or private CIDR block that requires access. Do not use 0.0.0.0/0 or ::/0.
Click Add Rule.
Verify that only trusted IP addresses or private network ranges are allowed to access TCP port 11211.
Using the Utho API
Update the Security Group to restrict access to port 11211.
curl -X PUT \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{...updated-security-group-rule...}' \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that the Security Group no longer allows unrestricted Incoming access to TCP or UDP port 11211.
Backout Plan:
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the affected Security Group.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Restore the previous rule if access to the Memcached service is required.
Save the Security Group configuration.
References: