Just wanted to say that I recently started reading RSS again and NewsBlur has been excellent. It’s a good aggregator, has a great web interface, and a great iOS app. The free tier is all you need (so I guess I’ll need to pay just out of my desire to support).
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
11–20 of 117 posts
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#12Lol, that’s the same footgun I discovered myself when was checking open ports. Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public?
How would docker know which interface is publicly accessible? Binding to localhost isn’t useful for actual deployments. Why not utilize the ingress/egress firewall rules offered by nearly all cloud/vps providers instead of relying on iptables of an instance?
> Why not utilize the ingress/egress firewall rules offered by nearly all cloud/vps providers instead of relying on iptables of an instance?
Because its advantageous to use all the facilities your OS provides. The fact that docker bypasses the highlevel firewall on the system and pokes holes through via iptables is very unfortunate, and something I myself have learned as recently as 2019.
Related to your question about docker knowing which interface to bind to, it generally sets up it's own docker network interface. With a highlevel firewall it's trivial to attach that interface to any firewall zone created (eg public zone with only specific ports exposed).
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#13Lol, that’s the same footgun I discovered myself when was checking open ports. Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public?
How would docker know which interface is publicly accessible? Binding to localhost isn’t useful for actual deployments. Why not utilize the ingress/egress firewall rules offered by nearly all cloud/vps providers instead of relying on iptables of an instance?
You can tame Docker with iptables by using the DOCKER-USER chain
There are a bunch of tutorials about how to tame Docker, but this one is the solution that I use and it was the simplest that I've found https://unrouted.io/2017/08/15/docker-firewall/
This way, even if you mistakenly expose your container ports to 0.0.0.0, you won't be able to access them until exposing them with iptables
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#14Nice read. It might be a good idea to also lock a user account after N failed password attempts. Mongo does not seem to support that off the shelf - https://www.mongodb.com/community/forums/t/limit-failed-logi... Neither do other databases like PG, curiously enough. The recommendation seems to be to link to LDAP or use authentication hooks. Or perhaps use client and server certificates for increased security - https:…
They becomes a highly effective denial of service vector if you’re not careful.
> if you’re not careful.
I don't think there's a way to avoid a DOS vector even if you're careful. If someone can access your database directly, they can make enough attempts to lock a user. The only way to be careful is to avoid public access to the db. But if you do that effectively, you don't have the issue of accounts getting locked.
It's a dubious argument to ever lock an account as a safety measure. Arguably, downtime is not a good tradeoff, especially if you're following best practices and using a very long, truly random password. An extremely secure db setup shouldn't require you to disable a "safety" feature that creates a new DoS vector because you've followed best practices.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#15[deleted]
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#16Kinda weird to blame Docker. This is pure user error.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#17You should consider yourself lucky that you didn't lose your users data.
My 2c:
- NEVER expose a database to the public. Use at least a micro-service BFEs that do exactly what the app needs and nothing more.
- Use a load balancer/gateway between your servers and the outside world (only port 80 and 443 should be open, 80 should redirect to 443).
- Use Docker-(Compose) as runtime/orchestrator only for development. For production use hardened cloud runtimes (e.g. Google Cloud Run, k3s/k8s, ...) with zero trust as default setting. Adhere to best practices!
- Before migrating production data, make sure everything works and nothing is exposed to the webs.
Tbh. I think your blog post is ridiculous, because IMHO the whole thing is your fault.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#18Using "ufw" on a production server is an anti-pattern, in my opinion. You should use something like ferm instead.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#19I'm glad this wasn't another "database lost, we have no backup" stories.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#20Fantastic write-up.
This seems to me like a combination of multiple foot-guns, first being the Docker one - followed by the fact Mongo was not configured to authenticate the connection.
Heroku by default run PostgreSQL open to the world (which is problematic for other reasons) but they get away with it by relying on PG's decent authentication.
My default is to prefer to build systems with multiple layers of security, such that there is no reliance on a single issue like this.