You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By default, port for leofs-adm operations listens not just on localhost but on all interfaces. Without firewall protection, all it takes is a single "echo ... | nc" command in the same network to create and delete users, delete buckets (thus wiping all data).
I think it should listen only on localhost for security reasons, except when explicitly enabled in config to listen on something else. It's unreasonable that everyone should be forced to setup firewall to protect against these dangerous operations.
The text was updated successfully, but these errors were encountered:
Now on the latest develop, administrative ports on managers listen on localhost(loopback) by default however it's obviously right direction in terms of its security OTOH our CI/Benchmark tool with default settings won't work because the tool expects leofs-adm to be able to communicate with other hosts so I'd have to reconfigure the below two files
to include console.bind_address = any to make it work.
Since the similar problems could happen on our users, we'd have to notify this change through our all public channels before 1.4.1 come out.
By default, port for leofs-adm operations listens not just on localhost but on all interfaces. Without firewall protection, all it takes is a single "echo ... | nc" command in the same network to create and delete users, delete buckets (thus wiping all data).
I think it should listen only on localhost for security reasons, except when explicitly enabled in config to listen on something else. It's unreasonable that everyone should be forced to setup firewall to protect against these dangerous operations.
The text was updated successfully, but these errors were encountered: