Latest Debian 12 update opens MariaDB server to the internet
4 comments
Have you reported it to Debian as a bug?
Yikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers.
The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying…
Can you repro on a fresh install?
I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.
To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening on :::3306.
It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.
So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket settings.