3 ms·
It feels like unsecured elasticsearch clusters are becoming the new s3/mongodb. I’ve been noticing increased scans for their default ports on servers I maintai
by kitotik 7y ago
It feels like unsecured elasticsearch clusters are becoming the new s3/mongodb.
I’ve been noticing increased scans for their default ports on servers I maintain.
It’s not very surprising given how insecure the defaults are for the typical ELK stack, and how tedious it is to actually setup sane authz.
- kakwa_ 7y agoWell, putting in place authentication can indeed be difficult, but making the ELK nodes only accessible by a limited set of IPs (preferably private ones) instead of being directly public facing should reasonably be expected.