Bug#342872: munin-node: listens on 0.0.0.0:4949
* Tore Anderson I'll have a talk to Nicolai and point him to this bug log, and let him decide if the default should be changed or not - I'll respect his choice, and consider merging any eventual change in trunk to the 1.2.x branch. Nicolai has had another look at it and didn't change his mind, so the default will continue to be to bind all interfaces. I will keep this bug open until I merge back the documentation improvements, though. -- Tore Anderson -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#342872: munin-node: listens on 0.0.0.0:4949
* Tore Anderson What issue is there that needs to be solved, exactly? * Marc Haber A potentially dangerous security issue. The code path from accepting to closing a connection according to the cidr_deny/deny configuration statements is fairly short and obvious so I'm sceptic as to whether this is a real concern or merely an academic one. If such a bug does exist, however, the issue would be critical regardless of the default configuration, as it could still be exploited by a user capable of connecting to 127.0.0.1, and in very many setups the node would be reconfigured to listen on all interfaces anyway (after all, it's what it's made for). I also note that packages such as Apache and others appear to employ a similar strategy as munin-node - listen on all interfaces, but restrict access to potentially sensitive data or functionality by way of application-specific access control lists. Listening on all interfaces was recently made the documented default (see http://munin.projects.linpro.no/changeset/1186), too.. It's of course possible to change this (at least in the developement trunk), so I'll have a talk to Nicolai and point him to this bug log, and let him decide if the default should be changed or not - I'll respect his choice, and consider merging any eventual change in trunk to the 1.2.x branch. (Oh and by the way, I fully agree that not having the loopback interface available inside a vserver sucks...) Regards -- Tore Anderson -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#342872: munin-node: listens on 0.0.0.0:4949
On Sun, Dec 11, 2005 at 02:25:54PM +0100, Marc Haber wrote: munin-node listens on 0.0.0.0:4949, and there doesn't seem to be a possibility to configure munin to only listen on 127.0.0.1:4949. This should be added, and it should actually be the default. This possibility is now there, but the bug in the Debian BTS was not properly handled. However, the default in Debian's configuration is host * which does not solve the issue. Please consider changing the default to 127.0.0.1 Greetings Marc -- - Marc Haber | I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things.Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#342872: munin-node: listens on 0.0.0.0:4949
* Marc Haber This possibility is now there, but the bug in the Debian BTS was not properly handled. I think this always have been possible - it's actually Net::Server that implements the functionality, and its host configuration option appears to be present in Sarge, too. I actually intended to close this bug when I realised that, but I forgot about it. However, the default in Debian's configuration is host * which does not solve the issue. Please consider changing the default to 127.0.0.1 I don't see what benefits you'll get from binding explicitly to the loopback interface, just a few disadvantages such as requiring deviation from upstream defaults, causing it to not work out of the box inside a vserver, and increasing the amount of configuration that must be done to allow remote Munin installations to query it (which'll probably increase support load as well). What issue is there that needs to be solved, exactly? Regards -- Tore Anderson -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#342872: munin-node: listens on 0.0.0.0:4949
On Thu, Oct 26, 2006 at 06:18:30PM +0200, Tore Anderson wrote: * Marc Haber However, the default in Debian's configuration is host * which does not solve the issue. Please consider changing the default to 127.0.0.1 I don't see what benefits you'll get from binding explicitly to the loopback interface, Security. What cannot be connected to cannot be exploited if buggy. What you have here is a process running with root privileges which can be connected to from anywhere. I do not need to list the security implications of that to you, do I? just a few disadvantages such as requiring deviation from upstream defaults, Actually, I'd suggest to change the upstream default as well. causing it to not work out of the box inside a vserver, Not having 127.0.0.1 is a bug in Linux-vserver, which is a big surprise to any experienced sysadmin who expects 127.0.0.1 to be the local host. and increasing the amount of configuration that must be done to allow remote Munin installations to query it (which'll probably increase support load as well). Remote munin installations need to be allowed by configuration anyway, and people running multiple munin-nodes are usually the people who are able to edit configuration. What issue is there that needs to be solved, exactly? A potentially dangerous security issue. Greetings Marc -- - Marc Haber | I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things.Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#342872: munin-node: listens on 0.0.0.0:4949
Package: munin-node Version: 1.2.3-3 Severity: wishlist Hi, munin-node listens on 0.0.0.0:4949, and there doesn't seem to be a possibility to configure munin to only listen on 127.0.0.1:4949. This should be added, and it should actually be the default. Greetings Marc -- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.14.3-zgsrv Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1) Versions of packages munin-node depends on: ii adduser 3.80 Add and remove users and groups ii libnet-server-perl0.89-1 An extensible, general perl server ii lsb-base 3.0-12 Linux Standard Base 3.0 init scrip ii perl 5.8.7-8Larry Wall's Practical Extraction ii procps1:3.2.6-2 /proc file system utilities Versions of packages munin-node recommends: ii libnet-snmp-perl 5.2.0-1Script SNMP connections -- no debconf information -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
