MySQL X protocol port 33060 listening on network by default

Status changed to 'Confirmed' because the bug affects multiple users.

A workaround is to add the following to one of the mysql config files, e.g., /etc/mysql/mysql.cnf:

[mysqld]
mysqlx_bind_address = 127.0.0.1

bind-address and mysqlx-bind-address both default to *, but the config file (/etc/mysql/mysql.conf.d/mysqld.cnf) sets bind-address to 127.0.0.1, so I think we just need to do the same for mysqlx-bind-address, as mentioned above.

This is a security issue, why don't you address it properly?
In addition, the fix is just simple.

It is addressed properly. This was fixed in https://salsa.debian.org/mariadb-team/mysql/-/commit/94e3a663b235d7720f7e98d9f34af27aace166ef

What Ubuntu releases (if any yet) include this change needs checking. If this needs fixing in a stable Ubuntu release, then this needs separate justification and consideration for regressing users. Closing a port that a user might be using in an update to a stable release will certainly regress users using that port.

Note that if you care, the workaround is to close the port in a configuration file is trivial. What remains is the trade-off in regressing users in stable releases versus a more sensible default.

mysql-8.0 is available only in focal, groovy, and hirsute.

Checking each release's mysqld.cnf for the fix:

  * focal: Missing
  * groovy: Has it
  * hirsute: Has it

To reiterate Robie's point, for 20.04 this would be a behavioral change, and while it is almost surely appropriate to do, in order to get it accepted by the SRU process there needs to be a strong justification of what the trouble is if it is left as-is.

From the description it sounds like the risk only presents itself if a user inadvertently mis-configures their system. I don't know if that actually happens in practice, or if not how likely it might be, but given that there's myriad ways for a naive user to make their system insecure I'm not sure this is a compelling enough use case.

Can someone present a plausible, clearly-problematic use case that could help justify an update to change this default in 20.04?

I'll sum up my view on this (which I had hoped, would be yours, too):

So far, in Ubuntu, mysqld always listened on port 3306 only, and only on the loopback interface by default. 20.04 introduced a mysql server version which introduces the MySQL X protocol. The expectation a mysql server administrator will have grown since, as well as anyone who expects Ubuntu to be 'secure by default' (https://wiki.ubuntu.com/SecurityTeam/Policies#No_Open_Ports), will be that a new Ubuntu release will not unexpectedly (and without notice) introduce new listening ports, especially not on the Internet, especially not for a service as sensitive as a database. However, this is what 20.04 does: the MySQL X service, is, by default, listening on all interfaces, on TCP port 33060.

As Bryce has clarified (thanks!), port 33060 *is* closed in later releases, which actually weakens the point that there are legitimate reasons to keep it open on 20.04 LTS. The potential regression which would be introduced by fixing this problem now (that 20.04 LTS has been released for a while), i.e. users who might since have come to expect that port 33060/tcp is listening on all interfaces, can be overcome having the preinstall/postinst script, or rather debconf, prompt about the desired configuration.

For what's it worth, Shodan.io lists several Ubuntu 20.04 systems which have the MySQL X protocol on 33060/tcp listening from the Internet.

The "MySQL X" network protocol provides effectively the same capabilities as the classic mysql network protocol (3306/tcp), and features a weak authentication method over a transport encrypted channel. Client implementations are provided, brute force attacks against the authentication are possible.

https://dev.mysql.com/doc/dev/mysql-server/latest/mysqlx_protocol.html#xprotocol_mysqlxshell_example
https://dev.mysql.com/doc/dev/mysql-server/latest/mysqlx_protocol_authentication.html

I would hope that the technical reasoning is sufficient to clarify the need for a SRU, but this should clarify how this can also pose a brand awareness / commercial risk.

I don't think having the port open by default is acceptable. It was clearly an oversight when the new MySQL version was prepared, and I suspect a lot of users are now running an open port without knowing about it.

While publishing out an update that closes the port may break certain configurations, I don't think it is appropriate to leave it open by default.

As such, I will be preparing a security update for focal that closes the open port, along with an appropriate USN that notifies users about the change in behaviour.

This bug was fixed in the package mysql-8.0 - 8.0.22-0ubuntu0.20.04.3

---------------
mysql-8.0 (8.0.22-0ubuntu0.20.04.3) focal-security; urgency=medium

  * SECURITY UPDATE: restrict open mysqlx port (LP: #1857584)
    - debian/additions/mysql.conf.d/mysqld.cnf: bind mysqlx port to
      127.0.0.1.
  * WARNING: This change may impact certain environments where the mysqlx
    port needs to be accessed from other hosts. A configuration change may
    be required.

 -- Marc Deslauriers <email address hidden> Thu, 26 Nov 2020 07:03:42 -0500