Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Administrative port on managers shouldn't listen on all interfaces #891

Closed
vstax opened this issue Oct 18, 2017 · 2 comments
Closed

Administrative port on managers shouldn't listen on all interfaces #891

vstax opened this issue Oct 18, 2017 · 2 comments

Comments

@vstax
Copy link
Contributor

vstax commented Oct 18, 2017

By default, port for leofs-adm operations listens not just on localhost but on all interfaces. Without firewall protection, all it takes is a single "echo ... | nc" command in the same network to create and delete users, delete buckets (thus wiping all data).
I think it should listen only on localhost for security reasons, except when explicitly enabled in config to listen on something else. It's unreasonable that everyone should be forced to setup firewall to protect against these dangerous operations.

@mocchira
Copy link
Member

Agreed. will fix with new configuration

### default: localhost for security reasons
console.bind_address = localhost

@mocchira mocchira added this to the 1.4.1 milestone Mar 30, 2018
@mocchira
Copy link
Member

mocchira commented Apr 6, 2018

Now on the latest develop, administrative ports on managers listen on localhost(loopback) by default however it's obviously right direction in terms of its security OTOH our CI/Benchmark tool with default settings won't work because the tool expects leofs-adm to be able to communicate with other hosts so I'd have to reconfigure the below two files

to include console.bind_address = any to make it work.
Since the similar problems could happen on our users, we'd have to notify this change through our all public channels before 1.4.1 come out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants