4 ms·
> i.e. the default configuration The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on
by nacs 11y ago
> i.e. the default configuration
The default configuration for MongoDB is to listen on localhost only. Someone changed the configuration if it was listening on a public IP.
- gruez 11y ago>The default configuration for MongoDB is to listen on localhost only That's true, but I remember that change was only made recently. Before, mongo would listen on all IPs and had no passwords.
- drzaiusapelord 11y agoThis is only true after the Mongo people were lambasted on the web for having such a terribly insecure out of the box product. Which was fairly recently. For years the product would bind to all IP addresses. Which is insane for a default install. Feb 2015: Discovered 40,000 vulnerable MongoDB databases on the Internet http://securityaffairs.co/wordpress/33487/hacking/40000-vulnerable-mongodbonline.html http://securityaffairs.co/wordpress/33487/hacking/40000-vuln... The changes were made after this, so we're only talking a few months now.
- eli 11y agoSome official distributions listened to all addresses by default (by design) until recently. https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/