Alternative headline: how my unauthenticated database ended up on the public web.
Exactly, like a bank that doesn’t lock it’s vault because the front door is locked.
Or, in this case, not locked
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
51–60 of 275 posts
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#52Free Download Sketchup 2015 Full Crack
https://download2021software.blogspot.com/2021/06/free-downl...
Review mamonde lip tint with Discount offer https://topsaleproductsonline.blogspot.com/2021/06/review-ma...
The aerodynamics of Argentavis, the world's largest flying bird https://www.interestingnews.club/2021/06/the-aerodynamics-of...
https://techtips2021.blogspot.com/2021/06/best-way-to-get-qu...
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#53Crap like this is why I dont run docker. I'm glad RedHat took a principled stance on it and dropped it. Podman doesn't punch holes you didn't ask for in your firewall. What a ludicrous anti-feature.
That might be true, but regardless of docker (or other, similar solutions), shouldn't MongoDB have had auth protection?
From 3.6 the default binding is localhost. That would be ook, except that if you mail the power, you listen to all interfaces. This will happen with Redis as well and is a problem with both docker and its dockerfile
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#54Earlier quoted context omitted.
That might be true, but regardless of docker (or other, similar solutions), shouldn't MongoDB have had auth protection?
Totally agreed with this. MongoDB’s default security posture is ridiculous, and amazingly it used to be even worse.
It’s exactly the same for redis, which means if used for jobs, you can insert arbitrary code.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#55Seems like poor network architecture to me. The fact that you can misconfigure a firewall on a VM or server which in turn allows public traffic is pretty dangerous.
To be fair, he was in the process of fixing the poor network architecture when this happened.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#56The mistake here is a MongoDB that didn't require authentication, not that docker's clunky iptables setup exposed it to the internet. Relying solely on a host-based firewall for access control is, for reasons which must now be obvious, admin incompetence. They are responsible for securing the containers. They didn't. Your services should be using authentication even if they are only bound to localhost.
> The mistake here is a MongoDB that didn't require authentication, not that docker's clunky iptables setup exposed it to the internet. It can be both.
It’s both indeed.. start to blame redis too.
It’s a docker problem, which should listen to localhost by default
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#57Wait... people run their databases on public IPs?
No, they run databases that listen to localhost, and then use docker to forward that private binding to the public ip
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#58Earlier quoted context omitted.
It's fairly normal for a laptop to be on a network behind a router/gateway. It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly. The latter is what probably happened here. Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pre…
'Really normal in the server world' is something i heavily disagree with. So there was no firewall then? https://www.digitalocean.com/blog/cloud-firewalls-secure-dro...
[deleted]
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#59This (Docker opening a hole in my firewall) is why I moved my dev server from Linode to Digital Ocean. DO provides a “cloud firewall” that provides something akin to AWS security groups and therefore can’t be messed by Docker. Linode doesn’t have anything like that (last time I checked at least).
They recently added one. In fact I had to move many of my VM's to new hypervisors because the ones that didn't support the cloud firewall were deprecated. I don't even use their cloud firewall.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
#60This (Docker opening a hole in my firewall) is why I moved my dev server from Linode to Digital Ocean. DO provides a “cloud firewall” that provides something akin to AWS security groups and therefore can’t be messed by Docker. Linode doesn’t have anything like that (last time I checked at least).
This is perhaps the best arguments I’ve seen for a separate firewall device even if it’s in the cloud (and just software) - something on your box running as root may bypass your rules just to help you.