| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALeZrrQba=GKdhQP-q31NGGvYZacVJFQEXveYyoS74K9BNLWGQ@mail.gmail.com> Date: Wed, 15 Feb 2012 10:30:30 -0600 From: "Schweiss, Chip" <chip@...ovates.com> To: bugtraq <bugtraq@...urityfocus.com> Subject: Puppet Dashboard insecure by default Apparently, leaving all security up to the end user is okay with Puppet Labs. I stumbled across some rather alarming search results when looking for an explanation to a message on my own dashboard: http://goo.gl/m99l6 There are numerous Puppet Dashboard's exposed directly to the Internet and indexed by Google. By default Dashboard runs on port 3000, so these are only sites that have reconfigured to run on port 80. A machine search for port 3000 would probably reveal magnitudes more sites. This problem effects all versions of Puppet Dashboard. When I reported this as a problem to Puppet Labs, their response was also alarming: "I'm sorry it took so long to get back to you. We definitely don't recommend people put their Dashboards on public internet, but it's not a code level security problem for us. I have instructed to docs people here to update to reflect the recommendation more strongly." Puppet Dashboard is wide open by default, has no built in security. There is no reason the Puppet Dashboard should even be wide open on a LAN as it will reveal all the details of every node configuration managed by Puppet. The workaround is straight forward, lock down the access to your Puppet Dashboard and don't run it as installed by default and definitely don't expose it to the Internet.
Powered by blists - more mailing lists