3 ms·
From 3.6 the default binding is localhost. That would be ook, except that if you mail the power, you listen to all interfaces. This will happen with Redis as we
by jbverschoor 5y ago
From 3.6 the default binding is localhost. That would be ook, except that if you mail the power, you listen to all interfaces. This will happen with Redis as well and is a problem with both docker and its dockerfile
- jessikat 5y agoEven on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.
- habibur 5y agoIf someone breaks into your server, database Auth won't protect you. And you have to reinstall everything including your database just to be sure he didn't leave holes in those. And the hacker can still delete your database or steal your data. He will simply download the datafiles and then delete those data from the server. Drop database done without a database password. And no, databases aren't kept encrypted on the server.
- dnet 5y agoNot necessarily -- there can be a number of reasons one can access localhost over the loopback interface that does _not_ imply root access: SSRF, misconfigured tunnels, or just a plain unpriviliged account where the attacker couldn't perform privilege escalation (either because the attacker's incompetence or the system being up-to-date and/or hardened)
- habibur 5y agoOk. Then add your password on these system when you design like that. That's not the default as most people feel otherwise.
- jbverschoor 5y agoYes. But by default things should not be open to anything but your machine. So let’s start blaming every piece of software that listens to localhost, but is exposed by docker. Not a fan of mongo, but the defaults are way better than before. Docker needs to fix their defaults