4 ms·
If you spin up a server and install mongodb (while forgetting to turn on a firewall that blocks all non-port 443/80 traffic) - everyone has root access to your
by ReverseCold 8y ago
If you spin up a server and install mongodb (while forgetting to turn on a firewall that blocks all non-port 443/80 traffic) - everyone has root access to your database.
Easy mistake to make. I've probably done it at least once on publicly accessible test instances.
- BLanen 8y agoThis just says to me that MongoDB's defaults should be changed. It's happening too much. A somewhat random password would at least provide some protection and minimal inconvenience for devs.
- thinkingemote 8y agoThe defaults on Ubuntu at least have been changed (not sure since when, though) "since release 2.6.0 we have made localhost binding the default configuration in our most popular deployment package formats, RPM and deb" from https://www.mongodb.com/blog/post/update-how-to-avoid-a-malicious-attack-that-ransoms-your-data https://www.mongodb.com/blog/post/update-how-to-avoid-a-mali...
- achillean 8y agoBy default, MongoDB doesn't listen on the public interface so it won't be exposed to the Internet - it only listens to localhost. Old versions of MongoDB had bad defaults but that hasn't been the case in years: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/
- j88439h84 8y agoI don't think this has been true for several years