snag.page

Every check · Open services

Open container APIs

services/containers · What it finds is shown only to the site's owner.

What it checks

Ports 2375 (Docker), 2379 (etcd), 10250 (Kubelet), 10255 (Kubelet read-only), 2376 (Docker over TLS), 6443 (Kubernetes).

Why it matters

One that answers without authentication lets anyone run code on the server.

How to fix it

  1. Find what listens on each port on the server.
  2. Close the port in your firewall.
  3. Bind the API to a private network or a Unix socket, as Docker does unless told otherwise.
  4. Where it must be reached from outside, require TLS client certificates.

Check a site for this and everything else: snag.page. More on open services: Open services Open databases Open remote access Known flaws