Skip to content

Default listen address is the global address #24

@sbts

Description

@sbts

Describe the bug
Currently the installer provided server-start script runs starman with 0.0.0.0 as the listen address

On which operating system
on all supported systems

How did you invocate the installer (full installer command line)
./ledgersmb-installer install

To Reproduce
Steps to reproduce the behavior:

  1. run the installer
  2. run ledgersmb/server-start
  3. non SSL access to LedgerSMB server is now available to all devices that can access any IP the local machine.
  4. this is bad, especially if on a public wifi network etc.

Expected behavior
LedgerSMB server should only be available on the local machine unless the user is warned about the risks and explicitly chooses to override that behaviour

Convenience is never an excuse for poor security practices, but the user is GOD, and may shoot them selves in the foot anytime they choose, but that should require them to override default behaviour

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions