Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Just launching keepass, even before opening a database, will open two port listeners on localhost on varying ports: $ sudo netstat -ltnp | grep mono tcp 0 0 127.0.0.1:35359 0.0.0.0:* LISTEN 2246259/mono tcp 0 0 127.0.0.1:49153 0.0.0.0:* LISTEN 2246259/mono These vary on each launch, and seem quite fishy for something as simple as a password manager. Unless I explicitly enable some sort of network sync, I wouldn't expect a password manager to just do that as a default behavior. Therefore, I suggest that whatever this feature is will be made opt-in instead. (Could e.g. be done with a dialog at launch if it's likely many will want to keep using this) Alternatively, whatever this even does should possibly be changed to use a Unix socket in the home folder instead. TCP/IP sockets are a bit problematic in a multi user environment since they're so open to even user-separated or often even containerized processes on the machine, so unless some sort of sync feature is explicitly enabled I feel like it'd be better to stay away from them here. Version-Release number of selected component (if applicable): 2.44-2.fc32 How reproducible: 100% Steps to Reproduce: 1. Launch keepass 2. Check netstat Actual results: two port listeners listed, different ones when quitting & relaunching keepass Expected results: no port listeners, at least not until keepass has prompted me for some inter process communication integration-with-other-apps feature or whatever this is to be actually enabled Additional info:
Thanks for the report. I see that there's been some discussion of this on the Debian bug tracker at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842541, where they concluded that the two open ports have different causes. They say that one of the issues has already been fixed in the development version of Mono (https://github.com/mono/mono/pull/18583). I believe that this change will be released in Mono 6.14, so we shouldn't expect to see this before Fedora 33 at the earliest. The other TCP port appears to be related to an encrypted IPC mechanism. Assuming it's well-implemented, this encryption should provide adequate protection, but, nevertheless, I have suggested upstream that this could be changed to a Unix domain socket. https://sourceforge.net/p/keepass/feature-requests/2574/
Wouldn't it make sense to leave this open until the keepass feature request #2574 is worked on? (You linked it already in the URLs part of this ticket, so it seems like it'll be easy to keep track of how things will go upstream while this is left open as a still unaddressed issue.)
My expectation is that no-one’s likely to do any work on this specific to Fedora, so I don’t think there’s any benefit to tracking it here.