3 ms·
memcached has the same default to this day - listen on all interfaces, no auth. These things are designed for use by people running them on servers that are no
by ploxiln 11y ago
memcached has the same default to this day - listen on all interfaces, no auth.
These things are designed for use by people running them on servers that are not directly exposed to the internet. If you're running it in a dev VM with no public address, it's fine. If you're running it on a database-optimized server in your datacenter/cloud which has a firewall only allowing connections from your web-application servers to particular ports, it's fine.
In fact I wouldn't trust mongodb auth anyway, that's not it's focus, much less its strength. Leave the auth to other mechanisms designed for it.
I try not to worry about the infinite multitude of idiots who can follow some bad advice and get some software running. No matter what you do to make things foolproof, human ingenuity comes up with better fools, and in the process you make things more complicated for people who know what they're doing.
"completely unacceptable"? no, reasonable.
- achillean 11y agoYeah... Memcached is one of the other ones that has the same problem but around 100,000 public instances... Maybe I shouldn't have even mentioned MongoDB since everybody's so focused on it now, but this sort of configuration issue affects a ton of database products.
- threeseed 11y agoIt actually affects a tonne of products, period. It's quite popular in enterprise software to listen on all interfaces.
- rodgerd 11y ago> These things are designed for use by people running them on servers that are not directly exposed to the internet. Just as well internal attacks and fraud are never a thing, and pivoting attacks up a chain of successively less secure components never happens.
- coldtea 11y agoFor any given system you can saw me I can show you 100 things that could be extra hardened. At some point you stop caring about security and start caring about convenience / practically.