A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

Post by sneak » Tue, Jun 29, 2021, 7:31 AM UTC

qbasic_forever wrote: post #7

sneak wrote: post #4

The mistake here is a MongoDB that didn't require authentication, not that docker's clunky iptables setup exposed it to the internet. Relying solely on a host-based firewall for access control is, for reasons which must now be obvious, admin incompetence. They are responsible for securing the containers. They didn't. Your services should be using authentication even if they are only bound to localhost.

The docker issue and original HN thread have countless instances of folks who have hit and been hacked by the exact same issue. There is clearly a major problem with the docker documentation, usage, etc. that is causing people to continually be taken by surprise with its iptables behavior. The blame game doesn't help solve the real problem that people are unknowingly putting services directly on the public internet w…

Post by okeuro49 » Tue, Jun 29, 2021, 7:32 AM UTC

Post by 1337shadow » Tue, Jun 29, 2021, 7:34 AM UTC

411111111111111 wrote: post #117

1337shadow wrote: post #100

Earlier quoted context omitted.

> Published ports > This creates a firewall rule which maps a container port to a port on the Docker host to the outside world. Source : https://docs.docker.com/config/containers/container-networki... Requiring authentication from localhost does not seem relevant to me, given that the creds would be stored somewhere, either in memory either in a file anyway, but exposing a port is not "binding on localhost". However…

> Another thing, instead of using exposing ports like that, the easiest is to use Docker-Compose, so that your containers of a stack have their own private shared network, then you won't have to publish ports to make your services communicate. That only works with local communication unless you use docker swarm. So byebye high availability. If you're going to make suggestions, at least think about them from a product…

Post by [deleted] » Tue, Jun 29, 2021, 7:39 AM UTC

eru wrote: post #109

bombcar wrote: post #60

Earlier quoted context omitted.

This is perhaps the best arguments I’ve seen for a separate firewall device even if it’s in the cloud (and just software) - something on your box running as root may bypass your rules just to help you.

Alternatively, running all your services as VMs also helps. Having root in a VM doesn't typically give you any rights on the hypervisor (at least not on eg Xen).

Post by dmix » Tue, Jun 29, 2021, 7:44 AM UTC

eru wrote: post #104

latch wrote: post #85

Earlier quoted context omitted.

> Staying away from it is still not the best strategy There's a whole generation of sysadmins that use docker so that they can stay away from foundational knowledge. We interview experienced devops who do not know/understand how to build basic packages from source (e.g. they don't understand the ./configure, make, make install chain) and who only have basic knowledge of the underlying operating system.

To be honest, I know how to type `./configure`, `make` and `make install`. And I know more about Gnu Make than I would admit in a job interview (for fear of someone expecting me to work with Make). But so far, life has been too short for me to waste my time on Gnu Autoconf. And I don't feel guilty about this, or like someone who doesn't know fundamentals. Autoconf is by all accounts a horrible system. Gnu Make ain't…