they are probably all Meteor tutorials.
I meant they are definitely not meteor tutorials.
Several thousand MongoDBs without access control on the Internet [pdf]
41–45 of 45 posts
Re: Several thousand MongoDBs without access control on the Internet [pdf]
#42Earlier quoted context omitted.
The first point in your article is: > "The most popular installer for MongoDB (RPM) limits network access to localhost by default." The first download for Linux at https://www.mongodb.org/downloads is: > https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-2.6.7.... At the bottom of the page there are alternate links to packages. Here is the description: > "MongoDB is included in several different package managers.…
Thanks for the suggestion, we will be updating the copy to clarify that the packages are the preferred installation method.
Thanks for listening!
Re: Several thousand MongoDBs without access control on the Internet [pdf]
#43Earlier quoted context omitted.
Memcached does, for one. This is (sensibly) turned off if you do "apt-get install memcached" or similar.
Only if you compile memcached from source. They can afford to do this because distro package maintainers give it sensible defaults on their behalf. MongoDB fucks this balance up by recommending you use their package repositories instead of distro maintained packages.
Just to add:
http://memcached.org/downloads
https://www.mongodb.org/downloads
Are identical in having normal binary downloads as the primary installation option.
And you seem to be implying that vendor supplied repositories are somehow unusual. They absolutely aren't.
Re: Several thousand MongoDBs without access control on the Internet [pdf]
#44Earlier quoted context omitted.
Only if you compile memcached from source. They can afford to do this because distro package maintainers give it sensible defaults on their behalf. MongoDB fucks this balance up by recommending you use their package repositories instead of distro maintained packages.
Just to add: http://memcached.org/downloads https://www.mongodb.org/downloads Are identical in having normal binary downloads as the primary installation option. And you seem to be implying that vendor supplied repositories are somehow unusual. They absolutely aren't.
> Are identical in having normal binary downloads as the primary installation option.
I don't believe I said that MongoDB recommended their packages over compiling from source.
> And you seem to be implying that vendor supplied repositories are somehow unusual.
Nope.
Re: Several thousand MongoDBs without access control on the Internet [pdf]
#45I tried to verify the results but am getting stuck at this:
curl $SHODANURL |grep -i class=\"ip\" |cut -d ’/’ -f 3 \ |cut -d ’"’ -f 1|uniq >db.ip
The author at CISPA (in the linked pdf) states to 'paste the html code' however using shodan from the command line, one only has access to 6 verbs that shodan understands. Shodan reveals 34309 mongo databases. I can download their ips but that requires 'query credits' using shodan. How does one use curl here?