Re: MongoDB Security & Defaults

2015-02-16 Thread Ryan S. Brown
On 02/16/2015 06:56 AM, Marek Skalický wrote: > Hello, > this change was in version 2.6.6-4. > > I were cleaning config files, adding new options,... I didn't want to > change any default configuration. Ah, makes sense. That mongod documentation is ripe for misinterpretation. > So bind_ip change

Re: MongoDB Security & Defaults

2015-02-16 Thread Marek Skalický
Hello, this change was in version 2.6.6-4. I were cleaning config files, adding new options,... I didn't want to change any default configuration. So bind_ip change isn't intended. I wrongly understood this mongod comment: "--bind_ip arg comma separated list of ip addresses to listen on

Re: MongoDB Security & Defaults

2015-02-13 Thread drago01
On Fri, Feb 13, 2015 at 11:37 PM, Ryan S. Brown wrote: > On 02/13/2015 11:25 AM, Frank Ch. Eigler wrote: >> "Ryan S. Brown" writes: >> >>> [...] In January, the Fedora rawhide package for mongo[2] was >>> changed to listen on all interfaces by default [...] To help >>> protect users, I think th

Re: MongoDB Security & Defaults

2015-02-13 Thread Ryan S. Brown
On 02/13/2015 11:25 AM, Frank Ch. Eigler wrote: > "Ryan S. Brown" writes: > >> [...] In January, the Fedora rawhide package for mongo[2] was >> changed to listen on all interfaces by default [...] To help >> protect users, I think the default should be changed back to >> localhost only. [...] >

Re: MongoDB Security & Defaults

2015-02-13 Thread Reindl Harald
Am 13.02.2015 um 17:25 schrieb Frank Ch. Eigler: "Ryan S. Brown" writes: [...] In January, the Fedora rawhide package for mongo[2] was changed to listen on all interfaces by default [...] To help protect users, I think the default should be changed back to localhost only. [...] We have a

Re: MongoDB Security & Defaults

2015-02-13 Thread Frank Ch. Eigler
"Ryan S. Brown" writes: > [...] In January, the Fedora rawhide package for mongo[2] was > changed to listen on all interfaces by default [...] To help > protect users, I think the default should be changed back to > localhost only. [...] We have a slew of network-servers in the fedora distribu

MongoDB Security & Defaults

2015-02-13 Thread Ryan S. Brown
Hello, After reading this article[1] on how many totally unsecured mongodb installations there are on the internet, I noticed a recent (and worrying) change in the defaults on Fedora's mongodb package. In January, the Fedora rawhide package for mongo[2] was changed to listen on all interfaces by