3 ms·
Latest Debian 12 update opens MariaDB server to the internet
I have a couple servers with Debian 12, running MariaDB. The servers were configured with bind-address 127.0.0.1:3306 so that any database connections are local.
I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.
To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening on :::3306.
It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.
So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket settings.
- debpalash 3mo agoYikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers.
- gib444 3mo agoCan you repro on a fresh install?
- atmosx 3mo agoThe Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…
- babuskov 3mo agoYeah, I have firewall set up to disallow everything except whitelisted ports, so my system was never in jeopardy. Maybe I should have mentioned that in my original post.
- khurs 3mo agoHave you reported it to Debian as a bug?
- gib444 3mo agoBug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141976 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141976