4 ms·

> DevOps, Developers, and IT practitioners often misconfigure some of the following: Binding the socket on the wrong network interfaces. For example, listening

• kawsper 5y ago
  Even if you've firewalled you machine, Docker will happily open up the ports to the world, you have to run it with "--iptables=false" to stop it. I accidentally opened up a Redis test-instance to the world like this.
  • qwertox 5y ago
    Is there any additional information on this? Assuming I add a rule via `iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP` and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as `docker run -d -p 0.0.0.0:8080:8080 some/server:latest` Will that container still be accessible to 123.123.123.132?
    • l33tman 5y ago
      I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.
    • malka 5y ago
      Yes. Docker will create specific rules for the lifetime of the container. I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.
    • remram 5y ago
      The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.
      • rzzzt 5y ago
        Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.
        • remram 5y ago
          Or iptables-save (note the nat and filter sections)
    • michaelcampbell 5y ago
      Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/ https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.
  • wiredfool 5y ago
    Even better, docker-compose doesn't do IPV6 (well). But if you have an IPV6 address, it will NAT all the incoming IPV6 traffic on the open ports to IPV4 using the internal network gateway address. So, if you're doing any filtering for internal network addresses == internal traffic, congratulations, now your inbound external IPV6 traffic is recognized as internal.
    • withinboredom 5y ago
      And even better 0.0.0.0 isn’t the default on Docker For Mac, leading devs to a false sense of security who develop on Macs.
  • efdee 5y ago
    Strange, I've never seen this before. I've been running Docker for years on one of my pet project machines, but while Docker is exposing the ports on 0.0.0.0 my iptables firewall blocks all of them. I'm not using --iptables=false but I'm not discounting the possibility that maybe I've configured this on a more global level somewhere.
    • tluyben2 5y ago
      That is still strange ; as you can read from others, docker refreshes it’s own iptable rules which then can mess with your own. Maybe you were lucky but seems unlikely to have that much luck. Be careful anyway; if you opened a port, it’ll be on 0.0.0.0 and docker does rearrange your iptables when the container(s) start. Especially default redis and mongo are good foot-shooters.
      • efdee 5y ago
        I don't quite understand it either. I just triple checked though, the ports are filtered from the outside. I do have a bunch of "docker network isolation" things going on in my iptables setup, so maybe that's why.
  • sethammons 5y ago
    We unknowingly did this at work. We had firewalls in place and docker was more than happy to open up redis to the world. Big lesson learned.
• mhitza 5y ago
  Exactly my past experience. Carefully tweaking firewalld a couple of years ago, then docker punched a hole through them by injecting their own iptables rules. Rules which where opaque to the firewall-cmd of course.
• Cthulhu_ 5y ago
  It's the kind of example that would make me uncomfortable to work with Docker / cloud things; I'm sure I could set up stuff within a day, but there's a lot of Things That You Should Happen To Know like this example that are easily missed - especially when you're in an environment where there's pressure on you to deliver, instead of a focus on doing things right.
• insaneworld 5y ago
  isn't it a standard practice to keep databases in private subnet or behind security groups? I even follow this standard rule for pet projects
  • vladvasiliu 5y ago
    I'm pretty sure that if you have no security group attached to an instance no traffic is allowed. And a new security group doesn't allow traffic from "everywhere" by default. You have to actively allow that.
• dspillett 5y ago
  > Binding to 0.0.0.0 is unfortunately the default for Docker. That isn't just a docker thing, though a few notable accidents with docker have shone a light on the issue in recent times, and is one of the reasons I much prefer to keep my firewall away from where things are running, between them and the unwashed masses on the public network. Even at home I have a separate small firewall box between the server that hosts things (and the rest of my network) instead of trusting that host to manage its own security in that way. If I run a service via docker or anything else on there, the outside world doesn't see it unless I open a way in elsewhere. For extra paranoia, the network leg that others can connect to (wireless AP & wired network ports in the guest room) is also separate and only sees parts of the server(s) I explicitly want it to (you can do this with vlans and such depending on your kit, I've actually just got an extra NIC on the router). Never assume a process/service/container/etc is at all locked down, unless you have checked it out yourself or have it sufficiently wrapped in things you have locked off.
• bluedino 5y ago
  A lot of tutorials that get copy/pasted for things like Python that do the same thing. It isn't until someone actually reads the docs and realizes what this code does that they understand that it's probably not what they want to do.