175K+ publicly-exposed Ollama AI instances discovered
1–10 of 41 posts
Re: 175K+ publicly-exposed Ollama AI instances discovered
#2This is a combination problem poor default (listening to all interfaces?) and also IPv6 can be publicly accessible. It's a bit dependent on how this is configured upstream by default, but this is a gotcha compared to IPv4.
Re: 175K+ publicly-exposed Ollama AI instances discovered
#3Nevermind. [0] Nothing to see here.
Re: 175K+ publicly-exposed Ollama AI instances discovered
#4This is a combination problem poor default (listening to all interfaces?) and also IPv6 can be publicly accessible. It's a bit dependent on how this is configured upstream by default, but this is a gotcha compared to IPv4.
The article says no, the default is listening to just localhost. Given the instances in question have been deliberately configured to listen on public ports, calling this misconfiguration seems somewhat unjustified.
Re: 175K+ publicly-exposed Ollama AI instances discovered
#5I see this happen all the time when people just want their new toys to work right away. They copy and paste commands from the internet to open up the connection but they forget to put a lock on the door. It is dangerous that so many people run these programs without understanding the basics of how networks work.
Re: 175K+ publicly-exposed Ollama AI instances discovered
#6This is a weakness of docker, a bit, I think.
I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost.
The use case https://github.com/meltyness/tax-pal
The ollama container is fairly easy to deploy, and supports GPU inference through container toolkit. I'd imagine many of these are docker containers.
e: i stand corrected, apparently -p of `docker run` can have a binding interface stipulated
e2: https://docs.docker.com/engine/containers/run/#exposed-ports which is not in some docs
e3: but it's in the man page ofc
Re: 175K+ publicly-exposed Ollama AI instances discovered
#7This is a weakness of docker, a bit, I think. I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost. The use case https://github.com/meltyness/tax-pal The ollama container is fairly easy to deploy, and supports GPU inference thro…
Out of curiosity, why would you need to wrap the call to an Ollama modelfile in docker? Does the dockerized ollama client provide some benefit, when it’s shelling down to local Ollama instance anyway?
(Wrt tax-pal)
Re: 175K+ publicly-exposed Ollama AI instances discovered
#8This is a weakness of docker, a bit, I think. I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost. The use case https://github.com/meltyness/tax-pal The ollama container is fairly easy to deploy, and supports GPU inference thro…
Out of curiosity, why would you need to wrap the call to an Ollama modelfile in docker? Does the dockerized ollama client provide some benefit, when it’s shelling down to local Ollama instance anyway? (Wrt tax-pal)
It's more of a distribution thing for me really. I'm basically using docker as a package manager since they otherwise distribute through one of those ad-hoc shell scripts that I'd prefer to avoid accidentally breaking Debian with somehow.
I've built ollama before too, but, I like that I can cleanly rip it out of my system or upgrade it without handing root off to some shell script somewhere I guess.
If anyone's gonna bash up my system it oughta be me
Re: 175K+ publicly-exposed Ollama AI instances discovered
#9This is a combination problem poor default (listening to all interfaces?) and also IPv6 can be publicly accessible. It's a bit dependent on how this is configured upstream by default, but this is a gotcha compared to IPv4.
The article says no, the default is listening to just localhost. Given the instances in question have been deliberately configured to listen on public ports, calling this misconfiguration seems somewhat unjustified.
Not true for their docker instructions which specify -p 11434:11434 instead of -p 127.0.0.1:11434:11434. [1]
Combine that with rootful docker's famous bypass of ufw and you have a publicly exposed ollama, even with a firewall. [2]
Re: 175K+ publicly-exposed Ollama AI instances discovered
#10Fun fact! On macOS you can expose privileged ports (But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error.
Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!