Ask HN: How to avoid accidentally opening a port to the world?

4 pointsnullbytesmatter3y ago2 comments

I recently discovered Solr (Jetty to be specific) binds to "::" by default, which is the ipv6 equivalent to "0.0.0.0". It essentially opened the Solr instance to the world.

I luckily caught it before indexing any data, but it opened my eyes to how easy it is for something like this to slip by. How can we prevent such things from happening?

I have since installed ufw and block all incoming traffic except to ports 22, 80 and 443 as a "layer" of defense (my thinking is, I won't accidentally expose a port this way).

2 comments

josephcsible3y ago

This is exactly what firewalls are for. Your "layer" of defense is the defense. If you want another layer, then set up another firewall further along the network.

ggm3y ago

This. NAT is not a firewall, never was. incidental benefit, which can't be relied on, specifically when there's no NAT (most v6)

j / k navigate · click thread line to collapse