Puppet Dashboard insecure by default

["Schweiss, Chip" <chip () innovates com>]

Apparently, leaving all security up to the end user is okay with Puppet Labs.

I stumbled across some rather alarming search results when looking for
an explanation to a message on my own dashboard:

http://goo.gl/m99l6

There are numerous Puppet Dashboard's exposed directly to the Internet
and indexed by Google.  By default Dashboard runs on port 3000, so
these are only sites that have reconfigured to run on port 80.  A
machine search for port 3000 would probably reveal magnitudes more
sites.

This problem effects all versions of Puppet Dashboard.

When I reported this as a problem to Puppet Labs, their response was
also alarming:

"I'm sorry it took so long to get back to you.  We definitely don't
recommend people put their Dashboards on public internet, but it's not
a code level security problem for us.  I have instructed to docs
people here to update to reflect the recommendation more strongly."

Puppet Dashboard is wide open by default, has no built in security.
There is no reason the Puppet Dashboard should even be wide open on a
LAN as it will reveal all the details of every node configuration
managed by Puppet.

The workaround is straight forward, lock down the access to your
Puppet Dashboard and don't run it as installed by default and
definitely don't expose it to the Internet.