5 ms·

This seems completely insecure. I just spun up the small cluster, and it does nothing to firewall off or isolate the instances from the internet? Eg, Zookeepe

by pquerna 12y ago

This seems completely insecure. I just spun up the small cluster, and it does nothing to firewall off or isolate the instances from the internet? Eg, Zookeeper is listening on port 2181 on the public internet? How is this OK?

deleted 12y ago
[deleted]
hueving 12y ago
Use iptables. I know it's a glib answer, but that's how hosting always worked until AWS came along and introduced filtering from an interface outside of the control of the OS.
- pquerna 12y ago
  That is a horrible glib answer. I was supposed to get a EASY TO USE, READY TO GO, Mesos development environment. So now I have to ssh to 5 boxes and manually add iptables rules? Why don't I just install Mesos myself then? Honestly this whole thing just reads to me as a marketing releases, not something I would recommend anyone to use. If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.
  - mrjatx 12y ago
    Digital Ocean has never, since their release, provided anything impressively technical with regard to their infrastructure. It's not surprising that this is half-assed as well.
  - hueving 12y ago
    >If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked. Did you confirm that the tooling is indeed missing?
    - pquerna 12y ago
      Yes, iptables is installed as a dependency of Docker, but is not configured to do anything: $ iptables -L -v Chain INPUT (policy ACCEPT 2172 packets, 459K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- any docker0 anywhere anywhere ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- docker0 !docker0 anywhere anywhere 0 0 ACCEPT all -- docker0 docker0 anywhere anywhere Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes) pkts bytes target prot opt in out source destination
vhost- 12y ago
Linode doesn't do this either. Nor do I want it to. It's my cluster and I should be responsible for firewalling it.
- threeseed 12y ago
  Given Linode's atrocious security record who cares what they do. The default should always be to listen on internal interfaces or have firewalls pre-configured.

by pquerna 12y ago

deleted 12y ago

[deleted]

hueving 12y ago

Use iptables. I know it's a glib answer, but that's how hosting always worked until AWS came along and introduced filtering from an interface outside of the control of the OS.

pquerna 12y ago
That is a horrible glib answer. I was supposed to get a EASY TO USE, READY TO GO, Mesos development environment. So now I have to ssh to 5 boxes and manually add iptables rules? Why don't I just install Mesos myself then? Honestly this whole thing just reads to me as a marketing releases, not something I would recommend anyone to use. If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.
- mrjatx 12y ago
  Digital Ocean has never, since their release, provided anything impressively technical with regard to their infrastructure. It's not surprising that this is half-assed as well.
- hueving 12y ago
  >If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked. Did you confirm that the tooling is indeed missing?
  - pquerna 12y ago
    Yes, iptables is installed as a dependency of Docker, but is not configured to do anything: $ iptables -L -v Chain INPUT (policy ACCEPT 2172 packets, 459K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- any docker0 anywhere anywhere ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- docker0 !docker0 anywhere anywhere 0 0 ACCEPT all -- docker0 docker0 anywhere anywhere Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes) pkts bytes target prot opt in out source destination

vhost- 12y ago

Linode doesn't do this either. Nor do I want it to. It's my cluster and I should be responsible for firewalling it.

threeseed 12y ago
Given Linode's atrocious security record who cares what they do. The default should always be to listen on internal interfaces or have firewalls pre-configured.