Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

don't expose services by default #2612

Merged
merged 2 commits into from
Oct 13, 2021
Merged

don't expose services by default #2612

merged 2 commits into from
Oct 13, 2021

Conversation

wkloucek
Copy link
Contributor

@wkloucek wkloucek commented Oct 12, 2021 •
edited
Loading

Description

Services won't listen anymore on 0.0.0.0 except the proxy.

ss -lntp | grep ocis before this PR:

LISTEN 0      4096       127.0.0.1:9250       0.0.0.0:*    users:(("ocis",pid=916562,fd=7))      
LISTEN 0      4096       127.0.0.1:45065      0.0.0.0:*    users:(("ocis",pid=916562,fd=28))     
LISTEN 0      4096               *:9150             *:*    users:(("ocis",pid=916562,fd=106))    
LISTEN 0      4096               *:9151             *:*    users:(("ocis",pid=916562,fd=105))    
LISTEN 0      4096               *:9215             *:*    users:(("ocis",pid=916562,fd=55))     
LISTEN 0      4096               *:9119             *:*    users:(("ocis",pid=916562,fd=17))     
LISTEN 0      4096               *:9216             *:*    users:(("ocis",pid=916562,fd=53))     
LISTEN 0      4096               *:9120             *:*    users:(("ocis",pid=916562,fd=47))     
LISTEN 0      4096               *:9185             *:*    users:(("ocis",pid=916562,fd=50))     
LISTEN 0      4096               *:9217             *:*    users:(("ocis",pid=916562,fd=38))     
LISTEN 0      4096               *:9154             *:*    users:(("ocis",pid=916562,fd=42))     
LISTEN 0      4096               *:9155             *:*    users:(("ocis",pid=916562,fd=39))     
LISTEN 0      4096               *:9124             *:*    users:(("ocis",pid=916562,fd=45))     
LISTEN 0      4096               *:9156             *:*    users:(("ocis",pid=916562,fd=21))     
LISTEN 0      4096               *:9125             *:*    users:(("ocis",pid=916562,fd=97))     
LISTEN 0      4096               *:9189             *:*    users:(("ocis",pid=916562,fd=46))     
LISTEN 0      4096               *:9157             *:*    users:(("ocis",pid=916562,fd=34))     
LISTEN 0      4096               *:9126             *:*    users:(("ocis",pid=916562,fd=98))     
LISTEN 0      4096               *:9190             *:*    users:(("ocis",pid=916562,fd=84))     
LISTEN 0      4096               *:9158             *:*    users:(("ocis",pid=916562,fd=31))     
LISTEN 0      4096               *:9191             *:*    users:(("ocis",pid=916562,fd=86))     
LISTEN 0      4096               *:9159             *:*    users:(("ocis",pid=916562,fd=23))     
LISTEN 0      4096               *:9160             *:*    users:(("ocis",pid=916562,fd=40))     
LISTEN 0      4096               *:9129             *:*    users:(("ocis",pid=916562,fd=96))     
LISTEN 0      4096               *:9161             *:*    users:(("ocis",pid=916562,fd=16))     
LISTEN 0      4096               *:9130             *:*    users:(("ocis",pid=916562,fd=100))    
LISTEN 0      4096               *:9194             *:*    users:(("ocis",pid=916562,fd=81))     
LISTEN 0      4096               *:9164             *:*    users:(("ocis",pid=916562,fd=30))     
LISTEN 0      4096               *:9100             *:*    users:(("ocis",pid=916562,fd=27))     
LISTEN 0      4096               *:9165             *:*    users:(("ocis",pid=916562,fd=22))     
LISTEN 0      4096               *:9134             *:*    users:(("ocis",pid=916562,fd=99))     
LISTEN 0      4096               *:9135             *:*    users:(("ocis",pid=916562,fd=59))     
LISTEN 0      4096               *:9200             *:*    users:(("ocis",pid=916562,fd=116))    
LISTEN 0      4096               *:9136             *:*    users:(("ocis",pid=916562,fd=52))     
LISTEN 0      4096               *:9104             *:*    users:(("ocis",pid=916562,fd=25))     
LISTEN 0      4096               *:42385            *:*    users:(("ocis",pid=916562,fd=77))     
LISTEN 0      4096               *:9140             *:*    users:(("ocis",pid=916562,fd=95))     
LISTEN 0      4096               *:9460             *:*    users:(("ocis",pid=916562,fd=76))     
LISTEN 0      4096               *:9205             *:*    users:(("ocis",pid=916562,fd=115))    
LISTEN 0      4096               *:9141             *:*    users:(("ocis",pid=916562,fd=92))     
LISTEN 0      4096               *:9142             *:*    users:(("ocis",pid=916562,fd=69))     
LISTEN 0      4096               *:9110             *:*    users:(("ocis",pid=916562,fd=57))     
LISTEN 0      4096               *:9143             *:*    users:(("ocis",pid=916562,fd=10))     
LISTEN 0      4096               *:9144             *:*    users:(("ocis",pid=916562,fd=29))     
LISTEN 0      4096               *:9145             *:*    users:(("ocis",pid=916562,fd=20))     
LISTEN 0      4096               *:9146             *:*    users:(("ocis",pid=916562,fd=41))     
LISTEN 0      4096               *:9114             *:*    users:(("ocis",pid=916562,fd=32))     
LISTEN 0      4096               *:9178             *:*    users:(("ocis",pid=916562,fd=14))     
LISTEN 0      4096               *:9115             *:*    users:(("ocis",pid=916562,fd=26))     
LISTEN 0      4096               *:9179             *:*    users:(("ocis",pid=916562,fd=15))     
LISTEN 0      4096               *:9147             *:*    users:(("ocis",pid=916562,fd=11))     
LISTEN 0      4096               *:9180             *:*    users:(("ocis",pid=916562,fd=110))    
LISTEN 0      4096               *:9148             *:*    users:(("ocis",pid=916562,fd=24))     
LISTEN 0      4096               *:9181             *:*    users:(("ocis",pid=916562,fd=109))    
LISTEN 0      4096               *:9149             *:*    users:(("ocis",pid=916562,fd=8))

and after this PR:

LISTEN 0      4096       127.0.0.1:9150       0.0.0.0:*    users:(("ocis",pid=915890,fd=106))    
LISTEN 0      4096       127.0.0.1:9151       0.0.0.0:*    users:(("ocis",pid=915890,fd=105))    
LISTEN 0      4096       127.0.0.1:9215       0.0.0.0:*    users:(("ocis",pid=915890,fd=82))     
LISTEN 0      4096       127.0.0.1:34463      0.0.0.0:*    users:(("ocis",pid=915890,fd=18))     
LISTEN 0      4096       127.0.0.1:9119       0.0.0.0:*    users:(("ocis",pid=915890,fd=10))     
LISTEN 0      4096       127.0.0.1:9216       0.0.0.0:*    users:(("ocis",pid=915890,fd=83))     
LISTEN 0      4096       127.0.0.1:9120       0.0.0.0:*    users:(("ocis",pid=915890,fd=69))     
LISTEN 0      4096       127.0.0.1:9217       0.0.0.0:*    users:(("ocis",pid=915890,fd=78))     
LISTEN 0      4096       127.0.0.1:9185       0.0.0.0:*    users:(("ocis",pid=915890,fd=36))     
LISTEN 0      4096       127.0.0.1:9154       0.0.0.0:*    users:(("ocis",pid=915890,fd=19))     
LISTEN 0      4096       127.0.0.1:9250       0.0.0.0:*    users:(("ocis",pid=915890,fd=7))      
LISTEN 0      4096       127.0.0.1:9155       0.0.0.0:*    users:(("ocis",pid=915890,fd=17))     
LISTEN 0      4096       127.0.0.1:9124       0.0.0.0:*    users:(("ocis",pid=915890,fd=58))     
LISTEN 0      4096       127.0.0.1:9156       0.0.0.0:*    users:(("ocis",pid=915890,fd=9))      
LISTEN 0      4096       127.0.0.1:9125       0.0.0.0:*    users:(("ocis",pid=915890,fd=103))    
LISTEN 0      4096       127.0.0.1:9157       0.0.0.0:*    users:(("ocis",pid=915890,fd=46))     
LISTEN 0      4096       127.0.0.1:9189       0.0.0.0:*    users:(("ocis",pid=915890,fd=14))     
LISTEN 0      4096       127.0.0.1:9126       0.0.0.0:*    users:(("ocis",pid=915890,fd=104))    
LISTEN 0      4096       127.0.0.1:9190       0.0.0.0:*    users:(("ocis",pid=915890,fd=86))     
LISTEN 0      4096       127.0.0.1:9158       0.0.0.0:*    users:(("ocis",pid=915890,fd=43))     
LISTEN 0      4096       127.0.0.1:9191       0.0.0.0:*    users:(("ocis",pid=915890,fd=91))     
LISTEN 0      4096       127.0.0.1:9159       0.0.0.0:*    users:(("ocis",pid=915890,fd=30))     
LISTEN 0      4096       127.0.0.1:9160       0.0.0.0:*    users:(("ocis",pid=915890,fd=27))     
LISTEN 0      4096       127.0.0.1:9129       0.0.0.0:*    users:(("ocis",pid=915890,fd=102))    
LISTEN 0      4096       127.0.0.1:9161       0.0.0.0:*    users:(("ocis",pid=915890,fd=40))     
LISTEN 0      4096       127.0.0.1:9130       0.0.0.0:*    users:(("ocis",pid=915890,fd=97))     
LISTEN 0      4096       127.0.0.1:9194       0.0.0.0:*    users:(("ocis",pid=915890,fd=85))     
LISTEN 0      4096       127.0.0.1:9100       0.0.0.0:*    users:(("ocis",pid=915890,fd=41))     
LISTEN 0      4096       127.0.0.1:9164       0.0.0.0:*    users:(("ocis",pid=915890,fd=34))     
LISTEN 0      4096       127.0.0.1:9165       0.0.0.0:*    users:(("ocis",pid=915890,fd=29))     
LISTEN 0      4096       127.0.0.1:9134       0.0.0.0:*    users:(("ocis",pid=915890,fd=96))     
LISTEN 0      4096       127.0.0.1:9135       0.0.0.0:*    users:(("ocis",pid=915890,fd=48))     
LISTEN 0      4096       127.0.0.1:9136       0.0.0.0:*    users:(("ocis",pid=915890,fd=47))     
LISTEN 0      4096       127.0.0.1:9104       0.0.0.0:*    users:(("ocis",pid=915890,fd=31))     
LISTEN 0      4096       127.0.0.1:9460       0.0.0.0:*    users:(("ocis",pid=915890,fd=71))     
LISTEN 0      4096       127.0.0.1:9140       0.0.0.0:*    users:(("ocis",pid=915890,fd=67))     
LISTEN 0      4096       127.0.0.1:9205       0.0.0.0:*    users:(("ocis",pid=915890,fd=115))    
LISTEN 0      4096       127.0.0.1:9141       0.0.0.0:*    users:(("ocis",pid=915890,fd=65))     
LISTEN 0      4096       127.0.0.1:9142       0.0.0.0:*    users:(("ocis",pid=915890,fd=66))     
LISTEN 0      4096       127.0.0.1:9110       0.0.0.0:*    users:(("ocis",pid=915890,fd=32))     
LISTEN 0      4096       127.0.0.1:9143       0.0.0.0:*    users:(("ocis",pid=915890,fd=12))     
LISTEN 0      4096       127.0.0.1:9464       0.0.0.0:*    users:(("ocis",pid=915890,fd=75))     
LISTEN 0      4096       127.0.0.1:9144       0.0.0.0:*    users:(("ocis",pid=915890,fd=38))     
LISTEN 0      4096       127.0.0.1:9145       0.0.0.0:*    users:(("ocis",pid=915890,fd=42))     
LISTEN 0      4096       127.0.0.1:9146       0.0.0.0:*    users:(("ocis",pid=915890,fd=51))     
LISTEN 0      4096       127.0.0.1:9114       0.0.0.0:*    users:(("ocis",pid=915890,fd=28))     
LISTEN 0      4096       127.0.0.1:9178       0.0.0.0:*    users:(("ocis",pid=915890,fd=24))     
LISTEN 0      4096       127.0.0.1:9179       0.0.0.0:*    users:(("ocis",pid=915890,fd=22))     
LISTEN 0      4096       127.0.0.1:9115       0.0.0.0:*    users:(("ocis",pid=915890,fd=16))     
LISTEN 0      4096       127.0.0.1:9147       0.0.0.0:*    users:(("ocis",pid=915890,fd=8))      
LISTEN 0      4096       127.0.0.1:9180       0.0.0.0:*    users:(("ocis",pid=915890,fd=109))    
LISTEN 0      4096       127.0.0.1:9148       0.0.0.0:*    users:(("ocis",pid=915890,fd=15))     
LISTEN 0      4096       127.0.0.1:9181       0.0.0.0:*    users:(("ocis",pid=915890,fd=110))    
LISTEN 0      4096       127.0.0.1:9149       0.0.0.0:*    users:(("ocis",pid=915890,fd=11))     
LISTEN 0      4096               *:9200             *:*    users:(("ocis",pid=915890,fd=111))

Related Issue

Motivation and Context

If you're running on a server without firewalls, all services are reachable from everywhere.

How Has This Been Tested?

  • ss -lntp
  • locally
  • CI

Screenshots (if appropriate):

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Technical debt
  • Tests only (no source changes)

Checklist:

  • Code changes
  • Unit tests added
  • Acceptance tests added
  • Documentation ticket raised:

@wkloucek wkloucek requested review from rhafer, refs, butonic and C0rby October 12, 2021 12:08
@wkloucek wkloucek force-pushed the dont-expose-services-by-default branch from fcd5b7d to e17eda7 Compare October 12, 2021 13:39
@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

0.0% 0.0% Coverage
33.3% 33.3% Duplication

rhafer
rhafer approved these changes Oct 12, 2021
View reviewed changes
Copy link
Contributor

@rhafer rhafer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, nice. Any particular reason, why this is in Draft?

@wkloucek
Copy link
Contributor Author

Ah, nice. Any particular reason, why this is in Draft?

Wanted to wait for some more feedback

C0rby
C0rby approved these changes Oct 13, 2021
View reviewed changes
Copy link
Contributor

@C0rby C0rby left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! :)

@wkloucek wkloucek marked this pull request as ready for review October 13, 2021 13:35
wkloucek added a commit to owncloud/web that referenced this pull request Oct 13, 2021
@wkloucek
expose gateway and drivers in preparation for owncloud/ocis#2612
1f572fc
@wkloucek wkloucek merged commit c60b76e into master Oct 13, 2021
@delete-merged-branch delete-merged-branch bot deleted the dont-expose-services-by-default branch October 13, 2021 13:43
ownclouders pushed a commit that referenced this pull request Oct 13, 2021
@wkloucek
commit c60b76e
b60dc27 
Merge: f136a58 e17eda7
Author: Willy Kloucek <[email protected]>
Date:   Wed Oct 13 15:43:43 2021 +0200

    Merge pull request #2612 from owncloud/dont-expose-services-by-default

    don't expose services by default
@wkloucek wkloucek mentioned this pull request Oct 13, 2021
Closed
pascalwengerter pushed a commit to owncloud/web that referenced this pull request Oct 14, 2021
@wkloucek
[deployment-examples] add wopi to deployment example (#5899)
89be3c7 
* add wopi to deployment example

* expose gateway and drivers in preparation for owncloud/ocis#2612
wkloucek added a commit to owncloud/web that referenced this pull request Oct 20, 2021
@wkloucek
adapt to changed vars from owncloud/ocis#2598 and don't override data…
327663f 
…gateway address because of owncloud/ocis#2612
@wkloucek wkloucek mentioned this pull request Oct 27, 2021
Merged
This was referenced Nov 24, 2021
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@refs refs refs approved these changes

@C0rby C0rby C0rby approved these changes

@rhafer rhafer rhafer approved these changes

@butonic butonic Awaiting requested review from butonic

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@wkloucek @rhafer @C0rby @refs