Hacker News Reader

Comment by blackcat201 | Hacker News Reader

I am not familiar with MongoDB but is there a mechanism in which white/blacklist base on IP, just like pg_hba in Postgresql which blocks/allows only certain IP access? Few years ago when I am still using MongoDB there's only basic authentication method(user password) which blocks unwanted access. I wonder if there's anything new now

View on HN

MongoDB 3.6, which was released in November 2016 defaults to listening on localhost only. A user must explicitly configure listening on a public IP address.

https://docs.mongodb.com/manual/release-notes/3.6-compatibil...

When running inside a docker container this won’t be much use though as the container handles the port forwarding. It would be a much better default to ensure authentication by default, considering how widespread exploiting of this has become with bots.

You don't have to bind to 0.0.0.0:[port]. If you want the server to remain accessible only locally, bind the container to 127.0.0.1:[port]. Docker is not preventing anyone from doing this.

Yeah that's all fine and dandy, but the docker default is to bind to 0.0.0.0, so it really should be taken into account. I honestly would have to go and look up the flags needed to change the bind address, but I know the port ones (as I'm sure do many people who copy/paste docker lines from random repos), so it's still insecure for a common configuration/setup.

I've never quite understood the opposition to just shipping mongodb with authentication on by default. What sort of use-case does it solve by not requiring it, and is it worth all the bad publicity every time this crops up in a new exploit report?

Reply on news.ycombinator.com