Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Several thousand MongoDBs without access control on the Internet [pdf]

cispa.saarland

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#31

Post by Kudos »

moozeek wrote: post #28

# 1st: accept connections from localhost iptables -A INPUT -p tcp -s 127.0.0.1 --dport 27017 -j ACCEPT iptables -A INPUT -p tcp -s 127.0.0.1 --dport 28017 -j ACCEPT # 2nd: drop from all others iptables -A INPUT -p tcp --dport 27017 -j DROP iptables -A INPUT -p tcp --dport 28017 -j DROP

# 3rd: change bind_ip from 127.0.0.1 to whatever in mongod.conf

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#33

Post by stennie »

moozeek wrote: post #28

# 1st: accept connections from localhost iptables -A INPUT -p tcp -s 127.0.0.1 --dport 27017 -j ACCEPT iptables -A INPUT -p tcp -s 127.0.0.1 --dport 28017 -j ACCEPT # 2nd: drop from all others iptables -A INPUT -p tcp --dport 27017 -j DROP iptables -A INPUT -p tcp --dport 28017 -j DROP

FYI, the Security section of the MongoDB manual has a checklist (http://docs.mongodb.org/manual/administration/security-check...) and example firewall configurations for iptables on Linux and netsh on Windows: http://docs.mongodb.org/manual/administration/security-netwo....

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#34

Post by meghan »

nailer wrote: post #24
meghan wrote: post #19

We take security seriously at MongoDB. Here is a response on security best practices from the MongoDB CTO & Co-Founder: http://www.mongodb.com/blog/post/mongodb-security-best-pract...

The first point in your article is: > "The most popular installer for MongoDB (RPM) limits network access to localhost by default." The first download for Linux at https://www.mongodb.org/downloads is: > https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-2.6.7.... At the bottom of the page there are alternate links to packages. Here is the description: > "MongoDB is included in several different package managers.…

Thanks for the suggestion, we will be updating the copy to clarify that the packages are the preferred installation method.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#35

Post by mason55 »

maltheal wrote: post #30
aikah wrote: post #21

Earlier quoted context omitted.

As I understand things based on the OP it seems however your documentation promotes the insecure way of setting up mongodb. It's even true that mongodb doesn't even ask to create db credentials during the installation,something it should do by default.

the real problem is lack of network protections. there are many things on the internet unprotected. this article is not news. dont put your database on the internet.

Security is a matter of layers, like an onion, it's not just an either-or. Any sensible database or database-like software does not come with authentication disabled by default. Yes, your DB should be behind a firewall, but if RedHat installed out of the box without a root password you wouldn't say "well your server should be behind a firewall anyway."

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#36

Post by pjungwir »

Kudos wrote: post #22
patio11 wrote: post #5

This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default. This is part of the Sliceh…

> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.

Once I somehow had an /etc/hosts that said something like

    127.0.0.1 localhost
    192.168.1.8 localhost
Consequently Postgres was binding to the external IP when it should have been listening on just 127.0.0.1. I only noticed it because I routinely nmap my servers after setting them up. In this case it probably didn't matter, since login would have still required a password, but it's one example of how easily misconfiguration can open holes. Not nearly as bad as Mongo's situation, but a lesson to me to check my work.

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#37

Post by pyvpx »

mercurial wrote: post #15
scrrr wrote: post #13

Please spend a little bit more money and hire a professional who knows what he is doing instead of just following installation tutorials.

You'd think Bouygues Telecom's people would qualify as "professional".

telecom, in general, isn't filled with the brightest of bulbs. especially in decision-making places...

Re: Several thousand MongoDBs without access control on the Internet [pdf]

#40

Post by JshWright »

patio11 wrote: post #5

This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default. This is part of the Sliceh…

There are some security disadvantages to running things like SSH on non-privileged ports. If it's running on a port > 1024, it's a lot easier to replace with a malicious keylogging version (for example...).
Post reply on HN