4 ms·
This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that
by patio11 12y ago
This can also happen with Memcached, Redis, and for that matter SQL databases. If you find it on your servers, you should be very, very alarmed. (Assume that any attacker with arbitrary access to any of these owns the box. [+]) One easy-ish way to make sure you don't inadvertently leave a port open is to use iptables and deny inbound connections to everything but 22, 80, and 443 by default.
This is part of the Slicehost VPS setup guide that PickledOnion wrote back in the day, and it's still one of the first things I do when I get a new box. (Typically right after locking down SSH with a key requirement.)
Edit to add:
http://articles.slicehost.com/2008/4/25/ubuntu-hardy-setup-page-1 http://articles.slicehost.com/2008/4/25/ubuntu-hardy-setup-p...
http://articles.slicehost.com/assets/2007/9/4/iptables.txt http://articles.slicehost.com/assets/2007/9/4/iptables.txt <-- make sure you change the port 30000 on the SSH to whatever you use on your boxes
[+] You might think "Well, that requires the existence of both a vulnerability in the server and a local privilege escalation exploit", but in practice, you can assume that the attacker has access to both of these. They also probably aren't trying to get into your box, specifically -- your box is merely one of the several thousand Redis instances on the Internet that they're firing e.g. a specially corrupted Unicode string to get a buffer overrun on, at which point they will -- in a mostly automated fashion -- run metasploit (or similar ratware) and turn that into a root shell.
- Kudos 12y ago> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.
- deleted 12y ago[deleted]
- patio11 12y agoMemcached does, for one. This is (sensibly) turned off if you do "apt-get install memcached" or similar.
- Kudos 12y agoOnly if you compile memcached from source. They can afford to do this because distro package maintainers give it sensible defaults on their behalf. MongoDB fucks this balance up by recommending you use their package repositories instead of distro maintained packages.
- threeseed 12y agoJust to add: http://memcached.org/downloads http://memcached.org/downloads https://www.mongodb.org/downloads https://www.mongodb.org/downloads Are identical in having normal binary downloads as the primary installation option. And you seem to be implying that vendor supplied repositories are somehow unusual. They absolutely aren't.
- Kudos 12y ago> Are identical in having normal binary downloads as the primary installation option. I don't believe I said that MongoDB recommended their packages over compiling from source. > And you seem to be implying that vendor supplied repositories are somehow unusual. Nope.
- pjungwir 12y agoOnce I somehow had an /etc/hosts that said something like 127.0.0.1 localhost 192.168.1.8 localhost Consequently Postgres was binding to the external IP when it should have been listening on just 127.0.0.1. I only noticed it because I routinely nmap my servers after setting them up. In this case it probably didn't matter, since login would have still required a password, but it's one example of how easily misconfiguration can open holes. Not nearly as bad as Mongo's situation, but a lesson to me to check my work.
- JshWright 12y agoThere are some security disadvantages to running things like SSH on non-privileged ports. If it's running on a port > 1024, it's a lot easier to replace with a malicious keylogging version (for example...).