zqr10159 commented on PR #4258: URL: https://github.com/apache/hertzbeat/pull/4258#issuecomment-5129930118
I added the narrow dependent follow-up #4295 for the remaining published listeners. This PR correctly scopes the Postgres and GreptimeDB ports, but the quick-start still publishes HertzBeat 1157/1158 on every interface while the bundled manager credential is unchanged. #4295 makes those listeners resolve to 127.0.0.1 by default and requires an explicit HERTZBEAT_BIND_ADDRESS choice for remote deployment. For the default quick-start exposure described here, I would treat #4258 plus #4295 as the complete mitigation. The static credentials still need replacement before an operator deliberately enables remote access. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
