3 ms·
> This can also happen with Memcached, Redis, and for that matter SQL databases. No one else binds to all interfaces by default.
by Kudos 12y ago
> This can also happen with Memcached, Redis, and for that matter SQL databases.
No one else binds to all interfaces by default.
- deleted 12y ago[deleted]
- patio11 12y agoMemcached does, for one. This is (sensibly) turned off if you do "apt-get install memcached" or similar.
- Kudos 12y agoOnly if you compile memcached from source. They can afford to do this because distro package maintainers give it sensible defaults on their behalf. MongoDB fucks this balance up by recommending you use their package repositories instead of distro maintained packages.
- threeseed 12y agoJust to add: http://memcached.org/downloads http://memcached.org/downloads https://www.mongodb.org/downloads https://www.mongodb.org/downloads Are identical in having normal binary downloads as the primary installation option. And you seem to be implying that vendor supplied repositories are somehow unusual. They absolutely aren't.
- Kudos 12y ago> Are identical in having normal binary downloads as the primary installation option. I don't believe I said that MongoDB recommended their packages over compiling from source. > And you seem to be implying that vendor supplied repositories are somehow unusual. Nope.
- pjungwir 12y agoOnce I somehow had an /etc/hosts that said something like 127.0.0.1 localhost 192.168.1.8 localhost Consequently Postgres was binding to the external IP when it should have been listening on just 127.0.0.1. I only noticed it because I routinely nmap my servers after setting them up. In this case it probably didn't matter, since login would have still required a password, but it's one example of how easily misconfiguration can open holes. Not nearly as bad as Mongo's situation, but a lesson to me to check my work.