Hacker News Reader

Comment by stephenr | Hacker News Reader

No auth? And it's over telnet so any auth will still be transmitted in plaintext. What next, it will ship with hard coded "admin" "password" for auth?

This is exactly why the version of devops where developers with no sysadmin/server management/etc experience try to manage servers scares the shit out of me.

View on HN

There are numerous ways to ensure this isn't accessible via an external source. Indeed, even if it did come with username/password authentication, or 2-factor authentication, it still would be an exploit waiting to happen if exposed.

You shouldn't be putting these things out on the open web in the first place.

So "No auth" isn't a bad thing, as there are better tools to ensure authorization is done before ever getting access.

Edit: should to shouldn't

This could be secured with a private network and a firewall. It would be nice if the readme mentioned the security vulnerability this exposes, and maybe a suggestion on how to secure the telnet port. I am sure that someone is going to install this without thinking to secure the telnet port.

Spoiler alert: Your "private" network isn't.

This seems like something that shouldn't be listening on 0.0.0.0, so no auth wouldn't be absolutely terrible.

But everyone knows that someone will use this on a production server with unsafe settings, especially if it doesn't restrict access by default.

This could be fairly secure with an IP whitelist on the port using something like IPTABLES, right?

Of course, you don't want it on your mission-critical production machine, but then that's not really what it's for.

I just started playing with this library, and then I had the same realization. I scanned through the readme for any mention of authentication and then put the brakes on.

Reply on news.ycombinator.com