Re:Finding MongoDB instances without any authentication
by rodgerd on Sunday July 19, 2015 @06:27PM
(#9913080)
> These things are designed for use by people running them on servers that are not directly exposed to the internet.
Just as well internal attacks and fraud are never a thing, and pivoting attacks up a chain of successively less secure components never happens.
Re:Finding MongoDB instances without any authentication
by coldtea on Sunday July 19, 2015 @11:18PM
(#9913853)
For any given system you can saw me I can show you 100 things that could be extra hardened.
At some point you stop caring about security and start caring about convenience / practically.
Re:Finding MongoDB instances without any authentication
by achillean on Sunday July 19, 2015 @05:26PM
(#9912883)
Yeah... Memcached is one of the other ones that has the same problem but around 100,000 public instances... Maybe I shouldn't have even mentioned MongoDB since everybody's so focused on it now, but this sort of configuration issue affects a ton of database products.
These things are designed for use by people running them on servers that are not directly exposed to the internet. If you're running it in a dev VM with no public address, it's fine. If you're running it on a database-optimized server in your datacenter/cloud which has a firewall only allowing connections from your web-application servers to particular ports, it's fine.
In fact I wouldn't trust mongodb auth anyway, that's not it's focus, much less its strength. Leave the auth to other mechanisms designed for it.
I try not to worry about the infinite multitude of idiots who can follow some bad advice and get some software running. No matter what you do to make things foolproof, human ingenuity comes up with better fools, and in the process you make things more complicated for people who know what they're doing.
"completely unacceptable"? no, reasonable.