Hacker News Reader

Comment by pquerna | Hacker News Reader

This seems completely insecure. I just spun up the small cluster, and it does nothing to firewall off or isolate the instances from the internet?

Eg, Zookeeper is listening on port 2181 on the public internet?

How is this OK?

View on HN

Use iptables. I know it's a glib answer, but that's how hosting always worked until AWS came along and introduced filtering from an interface outside of the control of the OS.

That is a horrible glib answer.

I was supposed to get a EASY TO USE, READY TO GO, Mesos development environment. So now I have to ssh to 5 boxes and manually add iptables rules? Why don't I just install Mesos myself then?

Honestly this whole thing just reads to me as a marketing releases, not something I would recommend anyone to use.

If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

Digital Ocean has never, since their release, provided anything impressively technical with regard to their infrastructure. It's not surprising that this is half-assed as well.

>If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

Did you confirm that the tooling is indeed missing?

Yes, iptables is installed as a dependency of Docker, but is not configured to do anything:

		$ iptables -L -v
		Chain INPUT (policy ACCEPT 2172 packets, 459K bytes)
		pkts bytes target     prot opt in     out     source               destination

		Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
		pkts bytes target     prot opt in     out     source               destination
		0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
		0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
		0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere

		Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes)
		pkts bytes target     prot opt in     out     source               destination

Linode doesn't do this either. Nor do I want it to. It's my cluster and I should be responsible for firewalling it.

Given Linode's atrocious security record who cares what they do.

The default should always be to listen on internal interfaces or have firewalls pre-configured.

Reply on news.ycombinator.com