PART 2 · NETWORK SECURITY IN SYSTEM ADMINISTRATION
Secure Connection: Why You Shouldn't Open 0.0.0.0:5432
A single line in docker-compose.yml determines whether your database is visible to the entire Internet, bypassing the firewall
Critical error: ports: - "5435:5432"
The correct standard: only 127.0.0.1 + an SSH tunnel
• An entry without an IP address binds the port to 0.0.0.0 (all of the host's network interfaces).
• On a Linux server, Docker writes rules directly to the DOCKER chain in iptables—often bypassing the standard ufw firewall!
• Within a few minutes, scanners detect the open DBMS port and begin brute-forcing passwords.
• In `docker-compose.yml`, we always specify the loopback interface: "127.0.0.1:5435:5432".
• On the developer’s local machine, DBeaver connects directly to 127.0.0.1:5435.
• On the remote server, port 5435 is not visible from the outside—the administrator enables the SSH Tunnel tab in DBeaver.
# Как работает подключение DBeaver к удалённому серверу без открытия порта БД наружу:
# [Ноутбук: DBeaver] ===(Зашифрованный SSH, порт 22)===> [Сервер: sshd] ---> [127.0.0.1:5435 (Postgres)]
# Эквивалентная команда проброса порта из терминала:
ssh -N -L 15435:127.0.0.1:5435 deploy@game-prod.example.com
# После этого локальный DBeaver подключается к localhost:15435 как к локальной базе!
Operating rule: The DBMS port (5432, 6379, 27017, 9000) must never be exposed to the public network—only the Docker internal network or 127.0.0.1.