Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

blog.newsblur.com

Post reply on HN
Print view View original

181–190 of 275 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#181

Post by eganist »

bildung wrote: post #179
eganist wrote: post #177

Earlier quoted context omitted.

> Is there any other profession were the professional, doing something wrong, would be called the victim? Would an engineer, having made an error when doing structural engineering calculations, be called a victim if the software used was too complex? Or a physician who overlooked adverse affects written in fine print? Or the electrician making errors when fixing things in a house with old wiring? I don't understand t…

Your actual original point was: > It's not all that great blaming the victim. Which is what I was replying to. Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker Newsblur customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the ou…

> Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker Newsblur customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.

See my previous note:

> There can be multiple victims, multiple causes/threat actors, and overlap between two categories.

I think we've both concluded now that newsblur was largely a victim as a consumer of docker.

Cheers, glad this helped.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#182

Post by dijit »

ramraj07 wrote: post #66

The biggest issue with docker is the false sense of security it seems to give a lot of engineers into thinking they know infra when they really don't. I stay away from this because I don't understand it fundamentally, and now this proves it's better to not think these new technologies are your friend unless you actually know what you're doing (which apparently most don't).

> the false sense of security it seems to give a lot of engineers into thinking they know infra when they really don't.

I don’t say this lightly: this is a big problem in our industry right now. DevOps means (to some) that developers now handle operations. The reality is that it’s difficult to juggle an operations mindset with a feature driven one.

Even if you focus on infra problems full time there is so much ground left uncovered, it would be impossible for anyone to juggle all of dev and all of infra at once, and this is compounded by the fact that ops is reductionist and dev is additive, which is an incredibly difficult problem for a person to reconcile and give full attention to one side. That’s why devops was supposed to be a division of labour; not just a dude/dudette who can configure nginx and write code.

Reminds me of this: https://www.weforum.org/agenda/2021/04/brains-prefer-adding-...

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#184

Post by 0xbadcafebee »

mschuster91 wrote: post #152
Alupis wrote: post #83

Earlier quoted context omitted.

MySQL/MariaDB have a completely open root account too... although default firewall rules should prevent public access too, unless Docker likes to punch that hole open too. Yes, root account password and access permissions should be changed upon a fresh install, but the real issue here is Docker's "helpfulness" by opening ports without explicit permission. That's absurd, and has no reasonable excuse.

> MySQL/MariaDB have a completely open root account too... That's flat out wrong. You can't start MySQL/MariaDB docker images without either explicitly specifying a root password, have it generate a random one on the first start of the container, or explicitly allowing an empty password. Regarding native installs of MySQL/MariaDB, the situation is a bit more murky, but at least the Ubuntu/Debian packages will ask you…

You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local development.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#185

Post by Liquid_Fire »

maple3142 wrote: post #180
aorth wrote: post #172

Earlier quoted context omitted.

> 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 I don't think Docker should touch the firewall whatsoever. Apache doesn't, nginx doesn't, PostgreSQL doesn't, etc. Why is Docker different? The sysadmin should decide that!

Maybe it is more convenient to developer so that they don't have to touch the firewall? Docker is not only used by sysadmin.

Why not add a --open-firewall-ports option and let the user decide? Maybe print a warning without that option if the port is not open if you really want to make it easy.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#186

Post by oblio »

Alupis wrote: post #83
thatwasunusual wrote: post #41

Earlier quoted context omitted.

That might be true, but regardless of docker (or other, similar solutions), shouldn't MongoDB have had auth protection?

MySQL/MariaDB have a completely open root account too... although default firewall rules should prevent public access too, unless Docker likes to punch that hole open too. Yes, root account password and access permissions should be changed upon a fresh install, but the real issue here is Docker's "helpfulness" by opening ports without explicit permission. That's absurd, and has no reasonable excuse.

That's how both Mongo and MySQL, back in the day, became so popular.

They had super lax security, making them easy to use for newbie devs, who are frequently scared/easily distracted by security settings.

I'm quite convinced the lack of security was by design. Growth hacking and all that. Get everyone onboard and once you have big business going on, you can focus on the minutiae of security, scaling, not losing data.

Node.js, PHP, Docker (heh!) most other popular techs did the same thing: super lax and frequently wrong defaults, just to get adoption.

As a startup it seems you either choose right/security or wrong/money :-)

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#187

Post by nickjj »

> When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world

Can Docker really be blamed here?

It sounds like when they ran MongoDB they explicitly published Mongo's port to the internet by either adding the ports property to docker-compose.yml or the -p flag with a Docker command to open Mongo's port to the outside world.

Not to pour salt on an open wound but why are they blaming Docker for this? Surely an ops person should have thought to check if any internal services are exposed to the outside world? This goes with or without using Docker. This would be like explicitly opening a port with iptables by copy / pasting something off the internet and then blaming iptables because it opened the port.

If anyone is curious, years ago I've blogged about the difference between expose and publish for Docker at https://nickjanetakis.com/blog/docker-tip-59-difference-betw....

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#188

Post by rmetzler »

dirkc wrote: post #163

Just want to confirm I understand the issue here. 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 2. `docker run -p 127.0.0.1:6666:6666 ...` - docker won't update the firewall. 3. `docker run -p 6666` - the port is published on 0.0.0.0 and a random port is opened on the host I see 3 being a little surprising, but 1 and 2 does what I would expect of it.

I think the one case you missed is

`docker run -p 6666:6666 ...` which defaults to `-p 0.0.0.0:6666:6666`

I can't find it in the article, but I suspect this what actually happened. It's a bad default and unfortunately most examples build on it.

Similar, it's easy to deploy MongoDB without a password. But it's also easy to set one, the docs even mention it https://hub.docker.com/_/mongo

And everyone can run a portscan with nmap against their servers. Unfortunately the MongoDB default ports 27017-27019 are not part of the top 1000 ports which nmap scans by default.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database

#189

Post by gerdesj »

simiones wrote: post #174

I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some extent. However, the much worse problem seems to be the fact that NewsBlur didn't test their network connectivity with something as basic as a port scan. This wasn't some complex attack based on some complex code injection jumping through legitimate ports or a…

Thank goodness that someone noticed the real problem: You can't see network traffic.

You don't write a program and deploy it without testing, so don't do the same with your firewalls. You need to actually test your firewall policy and not blindly assume it does what you think it should.

Post reply on HN