8 ms·
Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.
by jessikat 5y ago
Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.
- habibur 5y agoIf someone breaks into your server, database Auth won't protect you. And you have to reinstall everything including your database just to be sure he didn't leave holes in those. And the hacker can still delete your database or steal your data. He will simply download the datafiles and then delete those data from the server. Drop database done without a database password. And no, databases aren't kept encrypted on the server.
- dnet 5y agoNot necessarily -- there can be a number of reasons one can access localhost over the loopback interface that does _not_ imply root access: SSRF, misconfigured tunnels, or just a plain unpriviliged account where the attacker couldn't perform privilege escalation (either because the attacker's incompetence or the system being up-to-date and/or hardened)
- habibur 5y agoOk. Then add your password on these system when you design like that. That's not the default as most people feel otherwise.
- jbverschoor 5y agoYes. But by default things should not be open to anything but your machine. So let’s start blaming every piece of software that listens to localhost, but is exposed by docker. Not a fan of mongo, but the defaults are way better than before. Docker needs to fix their defaults