Insecure defaults from the setup instructions

[alexellis]

After following the setup instructions, all services appear to be directly exposed on the Internet which is never a good idea, Kibana for instance has no authentication or TLS configured.

Please consider removing this default in favour of accessing the dashboards via SSH tunnels or by using inlets.

Do the nodes even need a public IP? I hear that Packet now supports nodes with no public IPs, perhaps the terraform could provision a tiny Type0 to run Nginx as a reverse proxy with auth?

These are the ports that are open:

I do not consider this to be a security advisory that needs to be handled via backchannels or email, this is probably just an oversight. If the team feel otherwise I can remove the issue.

[nathangoulding]

Agreed. Can we collect some suggestions / thoughts?

• The terraform script we provide for packet demo could set some basic iptables rules if it detects a public interface. It could also accept a flag or parameter to disable that default behavior.

• We add a warning for those running the setup script manually, with some sane defaults.

Thoughts?

[alexellis]

Hi Nathan,

Glad that this resonates. My suggestions are in the original issue:

• 1. Use private Packet hosts only without any public IPs, with one Type0 added in which will act as a gateway running a reverse proxy Nginx would suit this task well and is easy to automate
• 2. Configuration as above, but with users accessing the hosts over ssh tunnels via a jump box, with nothing exposed publicly. ssh -L 5601:provisioner-ip:5601 root@jump-host then access via localhost:5601
• 3. Above configuration using inlets instead of SSH, punching out to an existing Packet host as a jump box.

I also think your idea about adding IP tables rules to prevent access to all of the above sounds good in principle. In practice Docker interferes with iptables and makes it impractical to achieve that result.

[alexellis]

Example of inlets with HTTPS provided by Caddy, Caddy has an open usage license now can also decorate endpoints with basic auth as required for things like Kibana. https://blog.alexellis.io/https-inlets-local-endpoints/

[mrmrcoleman]

First step is to add a warning on the website explaining that this is an insecure example while we're investigating an actual fix.

[alexellis]

@gianarb I saw you closed the other script relating to ports. I think this one needs addressing rather than closing. Hopefully I can pre-empt you there.

[gianarb]

This issue is ALWAYS in my mind! Yep we started something here #232 .

I think the same concept I tried to describe there applies here, but who knows, Kibana is not even part of the stack anymore.