HN Explorer

Latest Debian 12 update opens MariaDB server to the internet

1 points by babuskov ↗ HN
I have a couple servers with Debian 12, running MariaDB. The servers were configured with bind-address 127.0.0.1:3306 so that any database connections are local.

I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.

To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening to :::3306.

It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.

So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket sockets.

6 comments

[ 2.4 ms ] story [ 20.8 ms ] thread
debpalash
Yikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers.
gib444
Can you repro on a fresh install?
atmosx
The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…
babuskov
Yeah, I have firewall set up to disallow everything except whitelisted ports, so my system was never in jeopardy. Maybe I should have mentioned that in my original post.
khurs
Have you reported it to Debian as a bug?