5 ms·

I mean, the FBI should 1000000% know better than to expose their unsecured Elasticsearch cluster to the internet. While Elasticsearch should be more secure by d

I mean, the FBI should 1000000% know better than to expose their unsecured Elasticsearch cluster to the internet. While Elasticsearch should be more secure by default, I'd say the blame is much more on the agency.

tomc1985 5y ago
Has Elasticsearch done anything to fix its ridiculously bad lack of access control? People are fucking stupid, and expecting them not to fuck this up is a big ask. Too big, in fact. Secure by default or GTFO
- kieselguhr_kid 5y ago
  I think it's reasonable to expect the FBI to not expose this. I'm with you on Elasticsearch being too insecure but you're talking about secret government info. If they put that on the open internet that's a serious failure on their part and they'd have fucked it up with another tool if they weren't fucking it up with ES.
- clipradiowallet 5y ago
  Elasticsearch has nothing to fix - the product does precisely what the config tells it to. Maintainers of various distros ES packages are largely responsible for any [mis]configuration there. If you'd like to read how you can secure ES, go do that: https://www.elastic.co/what-is/open-x-pack https://www.elastic.co/what-is/open-x-pack PS: x-pack is the piece that adds authorization/authentication to ES.
  - altdataseller 5y ago
    You can setup username and pass auth in newer versions of Elastic without paying for xpack (I think at version 6 or up?)
    - clipradiowallet 5y ago
      X-pack is free now, they don't make you license it anymore. I wasn't aware of how to setup username/pass without it though (other than something like an nginx proxy in front of 9200/tcp with basic auth)
twobitshifter 5y ago
It’s not clear it was the FBI, the server was in Bahrain. This could be bigger than just an FBI screwup. Why is US SSI in an server in Bahrain?
- tomc1985 5y ago
  It could be something for the local US embassy. I knew some people in the foreign service that worked there once
  - baybal2 5y ago
    Can you tell more about that?
    - tomc1985 5y ago
      Not much to tell... old forum friend from back when forums were the big thing. We'd play videogames together that weren't too sensitive to lag in our off hours. She had a few stories from life there, I forget what her role was. At one point she got to shake the hand of the president and she showed me a picture of it. We lost touch and I have no idea what she's up to now.

tomc1985 5y ago

Has Elasticsearch done anything to fix its ridiculously bad lack of access control? People are fucking stupid, and expecting them not to fuck this up is a big ask. Too big, in fact. Secure by default or GTFO

kieselguhr_kid 5y ago
I think it's reasonable to expect the FBI to not expose this. I'm with you on Elasticsearch being too insecure but you're talking about secret government info. If they put that on the open internet that's a serious failure on their part and they'd have fucked it up with another tool if they weren't fucking it up with ES.
clipradiowallet 5y ago
Elasticsearch has nothing to fix - the product does precisely what the config tells it to. Maintainers of various distros ES packages are largely responsible for any [mis]configuration there. If you'd like to read how you can secure ES, go do that: https://www.elastic.co/what-is/open-x-pack https://www.elastic.co/what-is/open-x-pack PS: x-pack is the piece that adds authorization/authentication to ES.
- altdataseller 5y ago
  You can setup username and pass auth in newer versions of Elastic without paying for xpack (I think at version 6 or up?)
  - clipradiowallet 5y ago
    X-pack is free now, they don't make you license it anymore. I wasn't aware of how to setup username/pass without it though (other than something like an nginx proxy in front of 9200/tcp with basic auth)

twobitshifter 5y ago

It’s not clear it was the FBI, the server was in Bahrain. This could be bigger than just an FBI screwup. Why is US SSI in an server in Bahrain?

tomc1985 5y ago
It could be something for the local US embassy. I knew some people in the foreign service that worked there once
- baybal2 5y ago
  Can you tell more about that?
  - tomc1985 5y ago
    Not much to tell... old forum friend from back when forums were the big thing. We'd play videogames together that weren't too sensitive to lag in our off hours. She had a few stories from life there, I forget what her role was. At one point she got to shake the hand of the president and she showed me a picture of it. We lost touch and I have no idea what she's up to now.