security: mariadb.socket listens on [::]:3306, MariaDB answers on the public uplink #29

New issue

Closed

opened 2026-10-08 21:03:48 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-08 21:03:48 -03:00

(Migrated from github.com)

Found in the real-node test of the MariaDB pair, keel 0.23.3 (finding B3).

ID	Severity	Problem	Output
B3	High (security)	`mariadb.socket` (enabled since the CT was made from the image: in the etckeeper "initial commit", 2026-10-08 19:42) listens on `[::]:3306`, so `bind-address` has no effect. 3306 answers on the public uplink with no firewall (cloud simple). The manifest says `expose: mesh`, "never on the uplink". `keel diff` shows it as permanent drift.	`[::]:3306 mariadb.socket mariadb.service`; from the Proxmox host to db-1 uplink: `Host '<uplink>' is not allowed`; `database.server.listen: drift (declared ..., ::1, observed *)`

Evidence: Keel-Linux/handbook#60, docs/evidence/2026-10-08-mariadb-pair-real.md.

Found in the real-node test of the MariaDB pair, keel 0.23.3 (finding B3). | ID | Severity | Problem | Output | |---|---|---|---| | B3 | High (security) | `mariadb.socket` (enabled since the CT was made from the image: in the etckeeper "initial commit", 2026-10-08 19:42) listens on `[::]:3306`, so `bind-address` has no effect. 3306 answers on the public uplink with no firewall (cloud simple). The manifest says `expose: mesh`, "never on the uplink". `keel diff` shows it as permanent drift. | `[::]:3306 mariadb.socket mariadb.service`; from the Proxmox host to db-1 uplink: `Host '<uplink>' is not allowed`; `database.server.listen: drift (declared ..., ::1, observed *)` | Evidence: Keel-Linux/handbook#60, docs/evidence/2026-10-08-mariadb-pair-real.md.