I discovered thousands of open databases on AWS

Re:I discovered thousands of open databases on AWS by rbut on Monday January 31, 2022 @12:43AM (#30144987)

I’d assume a number of these would be due to the good old “docker punching a hole through UFW”, which still hasn’t been fixed.

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by giansegato on Monday January 31, 2022 @03:23AM (#30145756)

i'm very embarrassed to admit this, but i literally just discovered this. thought ufw was literally last defense. gotta run to fix this

(luckily, all just pet projects with no sensitive stuff - still…)

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by diftraku on Monday January 31, 2022 @05:30AM (#30146552)

We had this issue previously and solved it with ufw by using the built-in DOCKER-USER chain that allows you to filter traffic before it hits Docker's own rules. Adding the relevant lines to UFW's before.rules means they persist across reloads.

For more on Docker's built-in chains, see: https://docs.docker.com/network/iptables/#add-iptables-polic...

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by jeroenhd on Monday January 31, 2022 @05:17AM (#30146482)

Ha, this reminds me of the day I found out. I've port scanned my own servers ever since, just in case. It's such an easy footgun to fall for, they should really put a big scary warning somewhere on the Docker installation page for Ubuntu or something.

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by charcircuit on Monday January 31, 2022 @01:10AM (#30145124)

Why would you bind to a public IP and then use a firewall when you could just not bind to a public IP in the first place?

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by jeroenhd on Monday January 31, 2022 @05:21AM (#30146503)

The general expectation when running an application is that when you misconfigure your system, the firewall will at least block incoming traffic. If I run ./program, the system will prevent me from fucking up too badly, like it should if I docker run vendor/program, that extra layer of defence is gone.

Most programs still bind to 0.0.0.0 and that's not a problem if your firewall works the way you expect it to. Docker's firewall rules overriding UFW's firewall rules without notice is unexpected for many people.

I know I fell for this one years ago when I first messed around with Docker, luckily I wasn't running anything important.

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by rbut on Monday January 31, 2022 @01:51AM (#30145288)

Because people use docker-compose.yaml files verbatim, or copy docker run command lines, which more often than not do “-p 8000:8000”, instead of “-p 127.0.0.1:8000:8000”. Therein lies the issue.

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by MonaroVXR on Wednesday February 09, 2022 @05:34PM (#30279542)

What's the difference? Because the latter is your own device and the former still let's you connect to it.

I'm kinda sleepy, so I'm sure it's a stupid question.

Edit: 127.0.0.1 is only getting in and nobody else.

[ Parent | on HN ]

Re:I discovered thousands of open databases on AWS by spiffytech on Monday January 31, 2022 @08:29AM (#30147644)

Sometimes you want to allow traffic only from specific public IPs, or to rate limit traffic.

[ Parent | on HN ]