Latest Debian 12 update opens MariaDB server to the internet
I have a couple servers with Debian 12, running MariaDB. The servers were configured with bind-address 127.0.0.1:3306 so that any database connections are local.
I upgraded to Debian 12.15 today, rebooted and checked open ports just to see if all services are running.
To my surprise, MariaDB is no longer listening on 127.0.0.1:3306, but we have "init" listening on :::3306.
It looks like default config has changed to use Systemd sockets. Which I guess is fine, but silently making your database server accessible to the whole Internet doesn't sound like a good idea.
So, just PSA, if you rely on bind-address only, make sure you reconfigure the mariadb.socket settings. Yikes, on debain seems highly alarming, remeber times when used to turn to debain for stability and security of servers. The Damon should default to local host, however mariaDB is not some obscure daemon that runs for the kicks… so maybe, engineers should take the time to setup a firewall instead of assuming that all daemons listen to local host? Especially when the server is online? Just saying… Yeah, I have firewall set up to disallow everything except whitelisted ports, so my system was never in jeopardy. Maybe I should have mentioned that in my original post. Have you reported it to Debian as a bug? Can you repro on a fresh install?