zlacker

[return to "A story on home server security"]
1. mathar+q3[view] [source] 2025-01-05 13:25:05
>>todsac+(OP)
I think I'm missing something here - what is specific about Docker in the exploit? Nowhere is it mentioned what the actual exploit was, and whether for example a non-containerized postgres would have avoided it.

Should the recommendation rather be "don't expose anything from your home network publically unless it's properly secured"?

◧◩
2. phoron+o5[view] [source] 2025-01-05 13:45:26
>>mathar+q3
From TFA:

> This was somewhat releiving, as the latest change I made was spinning up a postgres_alpine container in Docker right before the holidays. Spinning it up was done in a hurry, as I wanted to have it available remotely for a personal project while I was away from home. This also meant that it was exposed to the internet, with open ports in the router firewall and everything. Considering the process had been running for 8 days, this means that the infection occured just a day after creating the database. None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet. Ofcourse I password protected it, but seeing as it was meant to be temporary, I didn't dive into securing it properly.

Seems like they opened up a postgres container to the Internet (IIRC docker does this whether you want to or not, it punches holes in iptables without asking you). Possibly misconfigured authentication or left a default postgres password?

◧◩◪
3. harral+MH1[view] [source] 2025-01-06 05:23:39
>>phoron+o5
Docker doesn’t expose ports by default. It only bypasses your firewall if you choose to explicitly publish a port.

OP explicitly forwarded a port in Docker to their home network.

OP explicitly forwarded their port on their router to the Internet.

OP may have ran Postgres as root.

OP may have used a default password.

OP got hacked.

Imagine having done these same steps on a bare metal server.

◧◩◪◨
4. phoron+MX1[view] [source] 2025-01-06 09:00:46
>>harral+MH1
I do imagine:

1. postgres would have a sane default pg_hba disallowing remote superuser access.

2. postgres would not be running as root.

3. postgres would not have a default superuser password, as it uses peer authentication by default.

4. If ran on a redhat-derived distro, postgres would be a subject to selinux restrictions.

And yes, all of these can be circumvented by an incompetent admin.

[go to top]