4 ms·
> Don't let your services listen on (AKA bind to) 0.0.0.0 or 127.0.0.1. How do I do that? Iptables? (Sorry if this is a dumb question.)
by an_ko 10y ago
> Don't let your services listen on (AKA bind to) 0.0.0.0 or 127.0.0.1.
How do I do that? Iptables? (Sorry if this is a dumb question.)
- baby 10y agohe means make them listen for 3.3.99.8 for example
- thewhitetulip 10y ago3.0.0.0/8 isn't loopback. Or did I miss something? I thought he said use 127.3.99.7 or something of that sort to avoid using the default localhost
- andrewstuart2 10y agoRight, and furthermore an address in 3.0.0.0/8 isn't likely to be added on any of your interfaces, so attempting to bind/listen on that will just fail. Even if you add it yourself, there's a tiny chance you might start redirecting some traffic you care about (say, facebook) to a local interface where facebook services are definitely not running. :-P Fortunately, the whole 127.0.0.0/8 block is automatically added to the loopback interface (edit: on Linux at least), so you can bind away to your heart's content.
- thewhitetulip 10y agothen how can you run the webapp if you aren't binding it to localhost? How will your PC know how to resolve 3.0.0.0/8?
- thewhitetulip 10y agono, it depends which language you use, but each allows you to 'listen' on an ip address and a port. The point is that the most commonly used IP is 127.0.0.1 but we can as well use 127.120.99.12 because the entire subnet is the loopback address. https://github.com/thewhitetulip/web-dev-golang-anti-textbook/blob/master/manuscript/2.0implementationBasics.md#basic-web-application https://github.com/thewhitetulip/web-dev-golang-anti-textboo... For an example in Go.
- andrewstuart2 10y agoIt's part of configuring whatever services you're running (or an option in your tcp/ip library if you're programming your own), and will depend on the service. For memcached for example, you can change the listen address with `-l <addr>`. Usually you just have to find the configuration documentation and ctrl-f search for "address," "bind address," "listen address," "IP address," etc. Or scan the page for something networking related. It's pretty much always a command line flag or config file parameter. If you're running with docker, it's even more standard. When you expose a port, just use `-p 127.12.12.3:11211:11211` (with your chosen IP address, of course), and docker will set up the forwarding for you, only for that address.
- JonnieCache 10y agoIs there a way to make root a requirement for binding to 0.0.0.0 though?
- TimPrice 10y agoSelinux (semanage port) and iptables (SECMARK?) might help you there.
- d0mine 10y agoTo choose an ip address from 127.0.0.0/8 subnet randomly in Python 3: >>> import ipaddress >>> import random >>> ipaddress.IPv4Address('127.0.0.1') + random.randrange(2**24 - 2) IPv4Address('127.23.181.175')
- wcarron27 10y agoHey, I know I'm a bit late to the party. But I'm looking to protect my company's redis instance from these attacks and your approach looks very promising. Things is, I don't know what to do now that I've written a similar script. Where should I use this code? In the redis.conf file? Bear in mind, I'm a front end developer, so this is absolutely not my forte. Thanks for the help.
- deleted 10y ago[deleted]