Merge pull request #2612 from owncloud/dont-expose-services-by-default

don't expose services by default
owncloud · Oct 13, 2021 · c60b76e · c60b76e
2 parents f136a58 + e17eda7
commit c60b76e
Show file tree

Hide file tree

Showing 32 changed files with 98 additions and 114 deletions.
diff --git a/accounts/pkg/flagset/flagset.go b/accounts/pkg/flagset/flagset.go
@@ -87,7 +87,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9181"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9181"),
  Usage: "Address to bind http server",
  EnvVars: []string{"ACCOUNTS_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,
@@ -115,7 +115,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "grpc-addr",
- Value: flags.OverrideDefaultString(cfg.GRPC.Addr, "0.0.0.0:9180"),
+ Value: flags.OverrideDefaultString(cfg.GRPC.Addr, "127.0.0.1:9180"),
  Usage: "Address to bind grpc server",
  EnvVars: []string{"ACCOUNTS_GRPC_ADDR"},
  Destination: &cfg.GRPC.Addr,

diff --git a/changelog/unreleased/dont-expose-services-by-default.md b/changelog/unreleased/dont-expose-services-by-default.md
@@ -0,0 +1,7 @@
+Security: Don't expose services by default
+
+We've changed the bind behaviour for all non public facing services. Before this PR
+all services would listen on all interfaces. After this PR, all services listen on
+127.0.0.1 only, except the proxy which is listening on 0.0.0.0:9200.
+
+https://github.com/owncloud/ocis/issues/2612
diff --git a/deployments/examples/ocis_wopi/docker-compose.yml b/deployments/examples/ocis_wopi/docker-compose.yml
@@ -67,6 +67,7 @@ services:
  OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
  OCIS_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
  # app registry
+ STORAGE_GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the REVA gateway accessible to the app drivers
  STORAGE_APP_REGISTRY_MIMETYPES_JSON: /var/tmp/ocis/app-config/mimetypes.json
  volumes:
  - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
@@ -90,6 +91,7 @@ services:
  command: storage-app-provider server
  environment:
  REVA_GATEWAY: ${REVA_GATEWAY:-ocis:9142}
+ APP_PROVIDER_BASIC_GRPC_ADDR: 0.0.0.0:9164
  APP_PROVIDER_BASIC_EXTERNAL_ADDR: ocis-appdriver-collabora:9164
  OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
  OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
@@ -115,6 +117,7 @@ services:
  #command: storage-app-provider server
  environment:
  REVA_GATEWAY: ${REVA_GATEWAY:-ocis:9142}
+ APP_PROVIDER_BASIC_GRPC_ADDR: 0.0.0.0:9164
  APP_PROVIDER_BASIC_EXTERNAL_ADDR: ocis-appdriver-onlyoffice:9164
  OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
  OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
@@ -142,6 +145,7 @@ services:
  #command: storage-app-provider server
  environment:
  REVA_GATEWAY: ${REVA_GATEWAY:-ocis:9142}
+ APP_PROVIDER_BASIC_GRPC_ADDR: 0.0.0.0:9164
  APP_PROVIDER_BASIC_EXTERNAL_ADDR: ocis-appdriver-codimd:9164
  OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
  OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}

diff --git a/glauth/pkg/flagset/flagset.go b/glauth/pkg/flagset/flagset.go
@@ -38,7 +38,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9129"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9129"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"GLAUTH_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -98,7 +98,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9129"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9129"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"GLAUTH_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -132,7 +132,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 
  &cli.StringFlag{
  Name: "ldap-addr",
- Value: flags.OverrideDefaultString(cfg.Ldap.Addr, "0.0.0.0:9125"),
+ Value: flags.OverrideDefaultString(cfg.Ldap.Addr, "127.0.0.1:9125"),
  Usage: "Address to bind ldap server",
  EnvVars: []string{"GLAUTH_LDAP_ADDR"},
  Destination: &cfg.Ldap.Addr,
@@ -147,7 +147,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 
  &cli.StringFlag{
  Name: "ldaps-addr",
- Value: flags.OverrideDefaultString(cfg.Ldaps.Addr, "0.0.0.0:9126"),
+ Value: flags.OverrideDefaultString(cfg.Ldaps.Addr, "127.0.0.1:9126"),
  Usage: "Address to bind ldap server",
  EnvVars: []string{"GLAUTH_LDAPS_ADDR"},
  Destination: &cfg.Ldaps.Addr,

diff --git a/graph-explorer/pkg/flagset/flagset.go b/graph-explorer/pkg/flagset/flagset.go
@@ -35,7 +35,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9136"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9136"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"GRAPH_EXPLORER_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -88,7 +88,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9136"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9136"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"GRAPH_EXPLORER_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -114,7 +114,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9135"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9135"),
  Usage: "Address to bind http server",
  EnvVars: []string{"GRAPH_EXPLORER_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,

diff --git a/graph/pkg/flagset/flagset.go b/graph/pkg/flagset/flagset.go
@@ -42,7 +42,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9124"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9124"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"GRAPH_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -95,7 +95,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9124"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9124"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"GRAPH_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -121,7 +121,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9120"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9120"),
  Usage: "Address to bind http server",
  EnvVars: []string{"GRAPH_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,

diff --git a/idp/pkg/flagset/flagset.go b/idp/pkg/flagset/flagset.go
@@ -38,7 +38,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9134"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9134"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"IDP_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -98,7 +98,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9134"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9134"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"IDP_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -124,7 +124,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9130"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9130"),
  Usage: "Address to bind http server",
  EnvVars: []string{"IDP_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,

diff --git a/ocis/pkg/flagset/flagset.go b/ocis/pkg/flagset/flagset.go
@@ -104,7 +104,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: "0.0.0.0:9010",
+ Value: "127.0.0.1:9010",
  Usage: "Address to debug endpoint",
  EnvVars: []string{"OCIS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -117,7 +117,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: "0.0.0.0:9010",
+ Value: "127.0.0.1:9010",
  Usage: "Address to bind debug server",
  EnvVars: []string{"OCIS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -143,7 +143,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: "0.0.0.0:9000",
+ Value: "127.0.0.1:9000",
  Usage: "Address to bind http server",
  EnvVars: []string{"OCIS_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,
@@ -157,7 +157,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "grpc-addr",
- Value: "0.0.0.0:9001",
+ Value: "127.0.0.1:9001",
  Usage: "Address to bind grpc server",
  EnvVars: []string{"OCIS_GRPC_ADDR"},
  Destination: &cfg.GRPC.Addr,

diff --git a/ocis/pkg/runtime/cmd/root.go b/ocis/pkg/runtime/cmd/root.go
diff --git a/ocs/pkg/flagset/flagset.go b/ocs/pkg/flagset/flagset.go
@@ -11,7 +11,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9114"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9114"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"OCS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -90,7 +90,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9114"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9114"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"OCS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -116,7 +116,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9110"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9110"),
  Usage: "Address to bind http server",
  EnvVars: []string{"OCS_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,

diff --git a/proxy/pkg/flagset/flagset.go b/proxy/pkg/flagset/flagset.go
@@ -42,7 +42,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9109"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9109"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"PROXY_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -102,7 +102,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9205"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9205"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"PROXY_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,

diff --git a/settings/pkg/flagset/flagset.go b/settings/pkg/flagset/flagset.go
@@ -35,7 +35,7 @@ func HealthWithConfig(cfg *config.Config) []cli.Flag {
  return []cli.Flag{
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9194"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9194"),
  Usage: "Address to debug endpoint",
  EnvVars: []string{"SETTINGS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -89,7 +89,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "debug-addr",
- Value: flags.OverrideDefaultString(cfg.Debug.Addr, "0.0.0.0:9194"),
+ Value: flags.OverrideDefaultString(cfg.Debug.Addr, "127.0.0.1:9194"),
  Usage: "Address to bind debug server",
  EnvVars: []string{"SETTINGS_DEBUG_ADDR"},
  Destination: &cfg.Debug.Addr,
@@ -115,7 +115,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "http-addr",
- Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "0.0.0.0:9190"),
+ Value: flags.OverrideDefaultString(cfg.HTTP.Addr, "127.0.0.1:9190"),
  Usage: "Address to bind http server",
  EnvVars: []string{"SETTINGS_HTTP_ADDR"},
  Destination: &cfg.HTTP.Addr,
@@ -143,7 +143,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
  },
  &cli.StringFlag{
  Name: "grpc-addr",
- Value: flags.OverrideDefaultString(cfg.GRPC.Addr, "0.0.0.0:9191"),
+ Value: flags.OverrideDefaultString(cfg.GRPC.Addr, "127.0.0.1:9191"),
  Usage: "Address to bind grpc server",
  EnvVars: []string{"SETTINGS_GRPC_ADDR"},
  Destination: &cfg.GRPC.Addr,

diff --git a/storage/pkg/command/groups.go b/storage/pkg/command/groups.go
@@ -157,22 +157,22 @@ func groupsConfigFromStruct(c *cli.Context, cfg *config.Config) map[string]inter
  }
 }
 
-// GroupProvider allows for the storage-groupprovider command to be embedded and supervised by a suture supervisor tree.
-type GroupProvider struct {
+// GroupSutureService allows for the storage-groupprovider command to be embedded and supervised by a suture supervisor tree.
+type GroupSutureService struct {
  cfg *config.Config
 }
 
-// NewGroupProvider creates a new storage.GroupProvider
+// NewGroupProviderSutureService creates a new storage.GroupProvider
 func NewGroupProvider(cfg *ociscfg.Config) suture.Service {
  if cfg.Mode == 0 {
  cfg.Storage.Reva.Groups.Supervised = true
  }
- return GroupProvider{
+ return GroupSutureService{
  cfg: cfg.Storage,
  }
 }
 
-func (s GroupProvider) Serve(ctx context.Context) error {
+func (s GroupSutureService) Serve(ctx context.Context) error {
  s.cfg.Reva.Groups.Context = ctx
  f := &flag.FlagSet{}
  cmdFlags := Groups(s.cfg).Flags

diff --git a/storage/pkg/command/storagemetadata.go b/storage/pkg/command/storagemetadata.go
@@ -159,7 +159,7 @@ func storageMetadataFromStruct(c *cli.Context, cfg *config.Config) map[string]in
 }
 
 // SutureService allows for the storage-metadata command to be embedded and supervised by a suture supervisor tree.
-type SutureService struct {
+type MetadataSutureService struct {
  cfg *config.Config
 }
 
@@ -168,12 +168,12 @@ func NewStorageMetadata(cfg *ociscfg.Config) suture.Service {
  if cfg.Mode == 0 {
  cfg.Storage.Reva.StorageMetadata.Supervised = true
  }
- return SutureService{
+ return MetadataSutureService{
  cfg: cfg.Storage,
  }
 }
 
-func (s SutureService) Serve(ctx context.Context) error {
+func (s MetadataSutureService) Serve(ctx context.Context) error {
  s.cfg.Reva.StorageMetadata.Context = ctx
  f := &flag.FlagSet{}
  cmdFlags := StorageMetadata(s.cfg).Flags