Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Security: don't bind to insecure address by default

See original GitHub issue

By default, microk8s binds to 0.0.0.0, which can lead to security issues. suppoie is a malware which seems to exploit this. Please consider removing the offending arg --insecure-bind-address=0.0.0.0.

Issue Analytics

State:
Created 5 years ago
Reactions:11
Comments:18 (5 by maintainers)

Top GitHub Comments

14reactions

StephanXcommented, Dec 18, 2018

Just my two bits, but I’d say the opposite: if users need to secure access to this local development tool, they should learn how to do so. Anyone who’s ever tried to kick the tires on redis knows the pain involved when you use a bind address of (say) 127.0.0.1 instead of 0.0.0.0.

9reactions

lmakarovcommented, Dec 17, 2018

I learned about this project at KuberCon last week and started playing with it on a cloud instance.

The instance got exploited within hours…

Since this project is focused on helping developers and novice users getting started with K8s, it would be good to have some bare minimum security to protect users from the obvious attack vectors with K8s.

Top Results From Across the Web

Security: don't bind to insecure address by default · Issue #110

I learned about this project at KuberCon last week and started playing with it on a cloud instance. The instance got exploited within...

Seeing a “Not Secure” Warning in Chrome? Here's Why and ...

For website owners/administrators. The “Not Secure” warning is being displayed on any page served over HTTP, which is an insecure protocol. If ...

Ensure the --insecure-bind-address argument is not set

Learn how to ensure that the --insecure-bind-address argument is not set with Bridgecrew's code security documentation.

How to Fix the HTTPS Not Secure Error - Seer Interactive

Once the crawl is complete, click “Reports” in the top ribbon, then “Insecure Content”. This will prompt a CSV report download to your...

2020 LDAP channel binding and LDAP signing requirements ...

A set of unsafe default configurations for LDAP channel binding and LDAP signing exist on Active Directory domain controllers that let LDAP clients...