search

Azure / azure-cli

Azure Command-Line Interface
MIT License
3.99k stars 2.96k forks source link

az webapp create-remote-connection should bound only to localhost (127.0.0.1) #15259

Open andxu opened 4 years ago

andxu commented 4 years ago

When using command az webapp create-remote-connection, this command listens on a port but it also accepts any connections not limited to current machine, by ssh root@< ip> -p <port>, any user under the same gateway will be able to connect to the ssh server proxy-ed by az webapp create-remote-connection, this is not safe(as the password is hard-coded).

See vscode app service implementation: https://github.com/microsoft/vscode-azuretools/blob/5999c2ad4423e86f22d2c648027242d8816a50e4/appservice/src/TunnelProxy.ts#L301

it only listens on 'localhost'

ghost commented 4 years ago

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.

yungezz commented 4 years ago

route to appropriate team

panchagnula commented 4 years ago

@btardif can you help me figure out if the current implementation on CLI - and why this is not limited to localhost?