APPENDIX · P17 · SAFETY · FOR SLIDES 17–18
← Back to Slide 17
P17. Redis and MongoDB do not have internet access
# Пример, не текущий Compose; адреса заменить на свои
# redis.conf
bind 127.0.0.1 10.0.0.5
protected-mode yes
aclfile /etc/redis/users.acl
# users.acl (одна строка на пользователя, вне репо)
user default off
user profiles on >REPLACE_ME ~player:* ~session:* +@read +@write -@dangerous +ping
# mongod.conf (предварительно создать admin)
net:
bindIp: 127.0.0.1,10.0.0.6
security:
authorization: enabled
How to check
External IP: No connection (port is closed).
No AUTH on 10.0.0.5: NOAUTH
only after "user default off".
AUTH profiles <secret> → PING;
authorized keys are available.
Mongo without login: Unauthorized
after creating an admin account and enabling auth.
Compose lab: internal, no ports;
Passwords are not enabled in this lab.
Not on the Internet
Minimum Rights
Secrets
Scanners detect exposed Redis and MongoDB instances; they delete the data and demand a ransom.
ACLs and roles: The profile service does not need FLUSHALL, CONFIG, KEYS, or third-party keys.
REPLACE_ME — this is just a placeholder; the actual password is in the ACL file outside the repository or secret store. TLS is required.
The lab is protected by a Docker network, not a password. Minimum requirements for the project: access only from the internal network, a password or ACL in Redis, and authorization in MongoDB.