4 ms·

MySQL/MariaDB have a completely open root account too... although default firewall rules should prevent public access too, unless Docker likes to punch that hol

by Alupis 5y ago

MySQL/MariaDB have a completely open root account too... although default firewall rules should prevent public access too, unless Docker likes to punch that hole open too. Yes, root account password and access permissions should be changed upon a fresh install, but the real issue here is Docker's "helpfulness" by opening ports without explicit permission. That's absurd, and has no reasonable excuse.

viraptor 5y ago
https://dev.mysql.com/doc/refman/8.0/en/default-privileges.html https://dev.mysql.com/doc/refman/8.0/en/default-privileges.h... > Installation of MySQL creates only a 'root'@'localhost' superuser account that has all privileges and can do anything. It's only a local account. Sure, it would be great to have a password on it, but it's not "a completely open root account".
- johannes1234321 5y ago
  > Sure, it would be great to have a password on it It has a password, which the user has to change, before they can do anything else. From that same page you linked: """ For data directory initialization performed manually using mysqld --initialize, mysqld generates an initial random password, marks it expired, and writes it to the server error log. """
- slim 5y ago
  That documentation is outdated. Debian does not prompt you for a password, it creates a root account but you can't connect to the database using "mysql -uroot" you can only use it if you are root on the server (I forgot how they do the trick)
berkes 5y ago
I've ran a few webhosting companies back in the heyday of LAMP/LEMP. This is a feature and a dangerous one. Our provisioning had to carefully manage the firewall during installation, because MySQL would be open to the world *while provisioning*. Often this is mere seconds or less, but on a reasonable popular webhosting, this is enough time for automated tools to take over the server. If, during that provisioning some other tool would start punching holes in the firewall you carefully manage from provisining, I would be enraged. I dislike Docker for a lot of reasons[0], and this kind of behaviour is one of them. So, yes: what MySQL or MongoDB do is dangerous and poor security practice. But what Docker does is worse: it breaks the countermeasures you take and rely on. IF all your layers of protection are removed by poor security practices of a tool that says "yea, but you need more than just this one layer" you still have no protection. [0] yet I do use it a lot on development-machines to run the services needed on localhost and not have to manage all those with apt/snap/brew or whatever they come with.
mschuster91 5y ago
> MySQL/MariaDB have a completely open root account too... That's flat out wrong. You can't start MySQL/MariaDB docker images without either explicitly specifying a root password, have it generate a random one on the first start of the container, or explicitly allowing an empty password. Regarding native installs of MySQL/MariaDB, the situation is a bit more murky, but at least the Ubuntu/Debian packages will ask you for a password during setup (and the bind-ip is 127.0.0.1 by default which means you'll have to mess around with conf.d files if you want to setup an externally-reachable server).
- 0xbadcafebee 5y ago
  You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local development.
  - mschuster91 5y ago
    I and the post I replied to was talking about MySQL. MongoDB is an insecure pile of cow poo that has been so often implicated in hacks and data thefts that I don't get why a) anyone is STILL using it and b) the containers STILL don't have a security-first default.
    - Alupis 5y ago
      I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A) Telling the developer first, B) Requesting permission to do so, C) Explaining why Docker wants to do so and D) Providing the ability to "opt-out" of this insecure-by-default configuration - is very bad. It doesn't matter how secure or insecure the software inside the container is... it shouldn't be allowed to communicate with the public unless the developer specifically requests it.
      - mschuster91 5y ago
        > It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. You are asking Docker to open firewall ports with the -p option, it explicitly even says in the manual that published ports will be reachable from everywhere that can access the IP you're publishing on (either default 0.0.0.0 or an IP of your choosing).
oblio 5y ago
That's how both Mongo and MySQL, back in the day, became so popular. They had super lax security, making them easy to use for newbie devs, who are frequently scared/easily distracted by security settings. I'm quite convinced the lack of security was by design. Growth hacking and all that. Get everyone onboard and once you have big business going on, you can focus on the minutiae of security, scaling, not losing data. Node.js, PHP, Docker (heh!) most other popular techs did the same thing: super lax and frequently wrong defaults, just to get adoption. As a startup it seems you either choose right/security or wrong/money :-)
- baq 5y ago
  does docker get money, though? anyone with just a bit of common sense has their own docker hub mirror and I don't know how else they earn money...
  - oblio 5y ago
    Docker figured out the adoption, but not the monetization... The development strategy did work, though.
- mgfist 5y ago
  > right/security or wrong/money :-) right/no users or wrong/yes users Not much point being right if no one uses the product :)
thatwasunusual 5y ago
> MySQL/MariaDB have a completely open root account too... My point was: why didn't the author of the article enable the use of authorisation? To rely on only a firewall is just stupid.

by Alupis 5y ago

viraptor 5y ago

https://dev.mysql.com/doc/refman/8.0/en/default-privileges.html https://dev.mysql.com/doc/refman/8.0/en/default-privileges.h... > Installation of MySQL creates only a 'root'@'localhost' superuser account that has all privileges and can do anything. It's only a local account. Sure, it would be great to have a password on it, but it's not "a completely open root account".

johannes1234321 5y ago
> Sure, it would be great to have a password on it It has a password, which the user has to change, before they can do anything else. From that same page you linked: """ For data directory initialization performed manually using mysqld --initialize, mysqld generates an initial random password, marks it expired, and writes it to the server error log. """
slim 5y ago
That documentation is outdated. Debian does not prompt you for a password, it creates a root account but you can't connect to the database using "mysql -uroot" you can only use it if you are root on the server (I forgot how they do the trick)

berkes 5y ago

I've ran a few webhosting companies back in the heyday of LAMP/LEMP. This is a feature and a dangerous one. Our provisioning had to carefully manage the firewall during installation, because MySQL would be open to the world *while provisioning*. Often this is mere seconds or less, but on a reasonable popular webhosting, this is enough time for automated tools to take over the server. If, during that provisioning some other tool would start punching holes in the firewall you carefully manage from provisining, I would be enraged. I dislike Docker for a lot of reasons[0], and this kind of behaviour is one of them. So, yes: what MySQL or MongoDB do is dangerous and poor security practice. But what Docker does is worse: it breaks the countermeasures you take and rely on. IF all your layers of protection are removed by poor security practices of a tool that says "yea, but you need more than just this one layer" you still have no protection. [0] yet I do use it a lot on development-machines to run the services needed on localhost and not have to manage all those with apt/snap/brew or whatever they come with.

mschuster91 5y ago

> MySQL/MariaDB have a completely open root account too... That's flat out wrong. You can't start MySQL/MariaDB docker images without either explicitly specifying a root password, have it generate a random one on the first start of the container, or explicitly allowing an empty password. Regarding native installs of MySQL/MariaDB, the situation is a bit more murky, but at least the Ubuntu/Debian packages will ask you for a password during setup (and the bind-ip is 127.0.0.1 by default which means you'll have to mess around with conf.d files if you want to setup an externally-reachable server).

0xbadcafebee 5y ago
You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local development.
- mschuster91 5y ago
  I and the post I replied to was talking about MySQL. MongoDB is an insecure pile of cow poo that has been so often implicated in hacks and data thefts that I don't get why a) anyone is STILL using it and b) the containers STILL don't have a security-first default.
  - Alupis 5y ago
    I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A) Telling the developer first, B) Requesting permission to do so, C) Explaining why Docker wants to do so and D) Providing the ability to "opt-out" of this insecure-by-default configuration - is very bad. It doesn't matter how secure or insecure the software inside the container is... it shouldn't be allowed to communicate with the public unless the developer specifically requests it.
    - mschuster91 5y ago
      > It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. You are asking Docker to open firewall ports with the -p option, it explicitly even says in the manual that published ports will be reachable from everywhere that can access the IP you're publishing on (either default 0.0.0.0 or an IP of your choosing).

oblio 5y ago

That's how both Mongo and MySQL, back in the day, became so popular. They had super lax security, making them easy to use for newbie devs, who are frequently scared/easily distracted by security settings. I'm quite convinced the lack of security was by design. Growth hacking and all that. Get everyone onboard and once you have big business going on, you can focus on the minutiae of security, scaling, not losing data. Node.js, PHP, Docker (heh!) most other popular techs did the same thing: super lax and frequently wrong defaults, just to get adoption. As a startup it seems you either choose right/security or wrong/money :-)

baq 5y ago
does docker get money, though? anyone with just a bit of common sense has their own docker hub mirror and I don't know how else they earn money...
- oblio 5y ago
  Docker figured out the adoption, but not the monetization... The development strategy did work, though.
mgfist 5y ago
> right/security or wrong/money :-) right/no users or wrong/yes users Not much point being right if no one uses the product :)

thatwasunusual 5y ago

> MySQL/MariaDB have a completely open root account too... My point was: why didn't the author of the article enable the use of authorisation? To rely on only a firewall is just stupid.