| [02:24:58] | * andifi[m] is now known as and712[m] |
| [05:01:01] | * friedrich[m]1 has quit (Quit: Idle for 30+ days) |
| [11:20:14] | <tool172[m]> | symbioquine: It always has CVS vulnerabilities on BSD usually including SQL injection techniques. |
| [11:26:54] | <symbioquine[m]> | Specifically on BSD? |
| [11:27:25] | <tool172[m]> | yes sir. I run a Freebsd home server on a xeon backbone. |
| [11:27:35] | <tool172[m]> | Nas, nextlcoud, webserver, mediaserver, etc |
| [11:27:45] | <tool172[m]> | parts are open to the internet |
| [11:28:05] | <symbioquine[m]> | No, I mean it's surprising to me that the vulnerbilities would be specific to BSD. |
| [11:28:15] | <tool172[m]> | unless they cleaned it up |
| [11:28:22] | <tool172[m]> | last two updates i did had open cvs |
| [11:28:32] | <tool172[m]> | most likely to all |
| [11:28:39] | <tool172[m]> | it's the web server that's the problem |
| [11:30:16] | <tool172[m]> | correction, the php scripting in the web serving |
| [11:30:23] | <tool172[m]> | sorry, i'm updating my dev environment right now |
| [11:30:33] | <symbioquine[m]> | But phpmyadmin doesn't include a web server (unless you choose a docker container or something) the vulnerbilities which phpmyadmin would be specifically responsible for would be at the php implementation layer. |
| [11:31:06] | <symbioquine[m]> | Don't get me wrong, there definitely is a steady stream of issues; https://www.cvedetails.com/vulnerability-list/vendor_id-784/Phpmyadmin.html |
| [11:32:09] | <tool172[m]> | i hear ya |
| [11:32:18] | <tool172[m]> | i just turn it on and shut it off on my apache server as needed |
| [11:32:34] | <symbioquine[m]> | But I think it may require a bit more nuanced evaluation since many large php projects have similar vulnerability history; |
| [11:32:34] | <symbioquine[m]> | * Drupal: https://www.cvedetails.com/vulnerability-list/vendor_id-1367/product_id-... |
| [11:32:34] | <symbioquine[m]> | * Wordpress: https://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-... |
| [11:37:23] | <mstenta[m]> | my two cents (FWIW): i stopped using phpmyadmin because it's just another thing to stay on top of with updates, increases attack surface, etc - when there are alternatives (eg: pure client apps like MySQL Workbench) that obviate the need for it entirely |
| [11:38:12] | <mstenta[m]> | but to each their own! i know a lot of folks just run it in dev too |
| [11:38:57] | <mstenta[m]> | i am curious to try the PHPStorm db features, since i'm already using PHPStorm, and MySQL Workbench isn't always super stable :-) |
| [11:39:13] | <tool172[m]> | i'm about to plugin with it today |
| [11:39:19] | <tool172[m]> | once i get my docker updated |
| [11:39:50] | <mstenta[m]> | also fwiw: i'm going to try to make postgresql the default for farmOS 2.x |
| [11:40:01] | <mstenta[m]> | MySQL Workbench does not support postgresql |
| [11:40:22] | <mstenta[m]> | there is an equivalent to phpmyadmin for postgresql |
| [11:40:35] | <mstenta[m]> | but i may just make the switch to using PHPStorm since it support postgresql as well |
| [11:40:42] | <symbioquine[m]> | But postgre has a great "workbench" tool |
| [11:40:42] | <mstenta[m]> | * but i may just make the switch to using PHPStorm since it supports postgresql as well |
| [11:40:47] | <symbioquine[m]> | *postgres |
| [11:40:47] | <tool172[m]> | it'll be fine |
| [11:41:09] | <mstenta[m]> | yea it looks great! i played with it a bit |
| [11:41:09] | <tool172[m]> | postgres i'm very familiar with from college |
| [11:41:13] | <mstenta[m]> | but i come back to: i want something i can use in dev and prod |
| [11:41:13] | <tool172[m]> | that was in 06' |
| [11:41:18] | <mstenta[m]> | and i don't want to install that on prod |
| [11:41:43] | <mstenta[m]> | just easier to have a consistent solution in both envs |
| [11:42:27] | <symbioquine[m]> | It's a good point about the attack surface area... my current mitigation is that I just bind the port only to localhost and use an SSH tunnel when I need to access it... |
| [11:42:37] | <mstenta[m]> | ah yea that works |
| [11:42:43] | <tool172[m]> | i literally enable and disable it as needed |
| [11:42:47] | <tool172[m]> | from the http.conf |
| [11:43:12] | <mstenta[m]> | still - i really like the idea of only running a client on my laptop - keeps the prod deployment simpler |
| [11:43:20] | <symbioquine[m]> | yeah |
| [11:43:27] | <mstenta[m]> | i wonder if either of them can connect to remote dbs? |
| [11:43:39] | <mstenta[m]> | if so you could run phpmyadmin in dockre locally |
| [11:43:55] | <symbioquine[m]> | Why not? Just forward the port with SSH... |
| [11:44:15] | <mstenta[m]> | true |
| [11:44:47] | <symbioquine[m]> | You could even use https://github.com/jnovack/docker-autossh to persistently expose the tunnel within a docker-compose stack... |
| [11:45:39] | <mstenta[m]> | near |
| [11:45:44] | <mstenta[m]> | * neat |
| [11:46:06] | <mstenta[m]> | i guess the other thing that would need to do, though, is tunnel through ssh... so you don't actually expose the db to the public at all |
| [11:46:18] | <mstenta[m]> | (or maybe that's what you meant) |
| [11:46:30] | <symbioquine[m]> | Yep, exactly. |
| [11:46:30] | <tool172[m]> | i use vpn and ssh |
| [11:46:47] | <symbioquine[m]> | I can't think of a reason I would ever expose the DB port beyond localhost. |
| [11:47:03] | <mstenta[m]> | i generally put DB on another server, with firewall rules so only the web server can access it |
| [11:47:07] | <symbioquine[m]> | well, at least not within a single-host environment |
| [11:47:31] | <symbioquine[m]> | Totally different situation once you start scaling up with multiple hosts. |
| [11:47:32] | <tool172[m]> | i use bsd users and groups to limit that |
| [11:47:41] | <mstenta[m]> | yea |
| [11:47:51] | <tool172[m]> | then run jails or vms with differnt ips and ports |
| [11:47:54] | <tool172[m]> | to limit access |
| [11:48:38] | <tool172[m]> | overhead is having mulitple mysql installs |
| [11:48:59] | <tool172[m]> | but data is cheap, and if they hacked the account, it's highest directory is the vm |
| [11:50:10] | <symbioquine[m]> | Once you have multiple hosts, firewall and/or some sort of network isolation is the way to go for sure. |
| [11:50:46] | <tool172[m]> | i use a software one on the server and my router |
| [11:50:51] | <tool172[m]> | i have like 5 pages on config notes |
| [12:11:57] | <tool172[m]> | in docker for the dev site what is the database location db@localhost? |
| [12:12:06] | <tool172[m]> | i'm trying to connect it to my phpstorm |
| [12:12:47] | <mstenta[m]> | `farm@db` |
| [12:12:48] | <mstenta[m]> | db name is `farm` |
| [12:12:50] | <mstenta[m]> | db host is `db` |
| [12:13:03] | <mstenta[m]> | (assuming you use the `docker-compose.development.yml` example |
| [12:13:10] | <mstenta[m]> | * (assuming you use the `docker-compose.development.yml` example) |
| [12:13:27] | <mstenta[m]> | https://farmos.org/development/docker/#database-setup |
| [12:13:56] | <tool172[m]> | thanks. i'm going to refill my joe |
| [12:14:00] | <mstenta[m]> | ACTION sent a long message: < https://matrix.org/_matrix/media/r0/download/matrix.org/CfXVWdRMTzJQZGmc... > |
| [12:14:18] | <mstenta[m]> | ACTION sent a long message: < https://matrix.org/_matrix/media/r0/download/matrix.org/LnJlMYOmcITUMOOH... > |
| [12:14:57] | <mstenta[m]> | gotta run - talk to you all later! |
| [12:15:01] | <mstenta[m]> | good luck tool172 ! |
| [12:15:11] | <tool172[m]> | later |
| [12:23:49] | <paul121[m]> | tool172: you prob figured this out, in PHPStorm the host is `localhost` not `db` - I believe `db` is only recognized in the docker containers? |
| [12:24:20] | <tool172[m]> | i'm having to rebuild all since i forgot my last creds |
| [12:24:31] | <tool172[m]> | i'll get back to that in a bit |
| [12:25:02] | <mstenta[m]> | Yes that's true! Good point "paul121" (https://matrix.to/#/@paul121:matrix.org) |
| [12:25:17] | <mstenta[m]> | And that's assuming you have 3306 opened from the container |
| [12:59:25] | <tool172[m]> | it's opened by the docker yml |
| [13:14:06] | * harry[m]2 has joined #farmos |
| [16:06:22] | * kader[m] has joined #farmos |
| [16:51:03] | * brent[m]2 has joined #farmos |
| [19:43:29] | * JustTB has joined #farmos |