The DEB.SURY.ORG Debian/ubuntu package repository has changed its package signing key. By running the below commands will fix the issue :

rm -rf /etc/apt/sources.list.d/php.list
apt-get update
apt-get -y install lsb-release ca-certificates curl
rm -rf /tmp/debsuryorg-archive-keyring.deb
curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
dpkg -i /tmp/debsuryorg-archive-keyring.deb
sh -c 'echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
apt-get update

then again run apt update command and upgrade command :

apt-get update
apt-get upgrade

In this tutorial we’ll secure Memcached server from UDP attacks in Dwbian and ubuntu servers which are common now a days, if you’re not using firewall and the memcached port is closed for the world you’re safe from this attacks.

If your Memcached server is only used by your local server then add the below line which will disable UDP  and only listen to localhost IP, which will prevent your server from being exposed on the internet by disabling the UDP protocol. UDP Protocol is now old technology which is not required anymore. TCP is more secure and today all are using it with Memcached.

Edit memcached config file :

nano /etc/memcached.conf

Add this line -l 127.0.0.1 -U 0 at the end of the file :

-l 127.0.0.1 -U 0

If your Memcached server is binding with ip, add the following OPTIONS line, which will only disable the UDP protocol:

-l -U 0

After that you need to restart the memcached server  and done.

systemctl restart memcached

Ensure you logged in as root user, ssh.

Step 1 :

Enable mod_remoteip :

a2enmod remoteip

Step 2 :

Now we need to modify and add some configs to apache2.conf

apt install nano
nano /etc/apache2/apache2.conf
Now add this line at the last of the config file :

RemoteIPHeader X-Forwarded-For
Now you need to replace the line for log format :

Find :

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined 

and replace that line with :

LogFormat "%a %h  %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined 

i.e. I’ve added only “%a”

Step 3 :

Then we need to create Apache Cloudflare trusted proxies conf file :

**create “remoteip.conf” file in location “/etc/apache2/conf-available/”

nano /etc/apache2/conf-available/remoteip.conf

Now paste this config and save it :

RemoteIPHeader CF-Connecting-IP
RemoteIPTrustedProxy 173.245.48.0/20
RemoteIPTrustedProxy 103.21.244.0/22
RemoteIPTrustedProxy 103.22.200.0/22
RemoteIPTrustedProxy 103.31.4.0/22
RemoteIPTrustedProxy 141.101.64.0/18
RemoteIPTrustedProxy 108.162.192.0/18
RemoteIPTrustedProxy 190.93.240.0/20
RemoteIPTrustedProxy 188.114.96.0/20
RemoteIPTrustedProxy 197.234.240.0/22
RemoteIPTrustedProxy 198.41.128.0/17
RemoteIPTrustedProxy 162.158.0.0/15
RemoteIPTrustedProxy 104.16.0.0/12
RemoteIPTrustedProxy 172.64.0.0/13
RemoteIPTrustedProxy 131.0.72.0/22
RemoteIPTrustedProxy 2400:cb00::/32
RemoteIPTrustedProxy 2606:4700::/32
RemoteIPTrustedProxy 2803:f800::/32
RemoteIPTrustedProxy 2405:b500::/32
RemoteIPTrustedProxy 2405:8100::/32
RemoteIPTrustedProxy 2a06:98c0::/29
RemoteIPTrustedProxy 2c0f:f248::/32

Next restart Apache service and check the log and check the real ips are now logging :

systemctl restart apache2

Short Description on curl :

curl is a command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features. curl is used in command lines or scripts to transfer data. It is also used in cars, television sets, routers, printers, audio equipment, mobile phones, tablets, settop boxes, media players and is the internet transfer backbone for thousands of software applications affecting billions of humans daily.

Step 1 :
Remove current installed curl if installed :

apt remove curl
apt purge curl

Step 2 :
Install Curl dependencies :

apt install -y build-essential libcurl4 openssl libssl-dev libssh-dev zlib1g-dev zlib libbrotli-dev brotli libkrb5-dev libldap2-dev librtmp-dev libpsl-dev libnghttp2-dev

Step 3 :
Download and Install curl :

run this commands one by one in ssh terminal :

cd /usr/local/src
rm -rf curl*
wget https://curl.se/download/curl-8.3.0.zip
unzip curl-8.3.0.zip
cd curl-8.*/
./configure --with-ssl --with-zlib --with-gssapi --enable-ldap --enable-ldaps --with-libssh --with-nghttp2
make
make install

Step 4:
Checking curl version :

curl -V

example output :

root@mysterydata:# curl -V
curl 8.3.0 (x86_64-pc-linux-gnu) libcurl/8.3.0 OpenSSL/1.1.1 zlib/1.2.11 brotli/1.0.4 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) libssh/0.7.0/openssl/zlib nghttp2/1.30.0 librtmp/2.3
Release-Date: 2023-09-13
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets

Thats it you’ve installed latest curl version on Ubuntu server

Troubleshoot :
if you get this errors :

curl: symbol lookup error: curl: undefined symbol: curl_url_cleanup
curl: symbol lookup error: curl: undefined symbol: curl_mime_free
Run the below Steps ensure you’re using root (sudo):

apt build-dep curl
Then run Step 3 commands

Now Run this command to build shared lib cache and links :

ldconfig

ZLIB not found or not installing

*** Unable to locate package zlib

you can install ZLib from repository :

apt install zlib1g-dev zlib1g

Zlib Install from DEB :

For Ubuntu :

cd /usr/local/src
wget http://security.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.2.11.dfsg-2ubuntu5_amd64.deb
wget http://security.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g-dev_1.2.11.dfsg-2ubuntu5_amd64.deb
dpkg -i zlib1g_1.2.11.dfsg-2ubuntu5_amd64.deb
dpkg -i zlib1g-dev_1.2.11.dfsg-2ubuntu5_amd64.deb

Zlib Install from Source :

cd /usr/local/src
wget http://www.zlib.net/zlib1211.zip
unzip zlib1211.zip
cd zlib-1.2.11
./configure --prefix=/usr/local/zlib
make && make install