Re: [Gluster-infra] Cage internal network lock down

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Le vendredi 15 juin 2018 à 18:35 +0200, Michael Scherer a écrit :
> Le mardi 13 mars 2018 à 17:22 +0100, Michael Scherer a écrit :
> > Hi,
> > 
> > So, I have been working on tightening the internal network of the
> > gluster community cage part of the world, e.g., all the servers in
> > *.int.rht.gluster.org. That's mostly internal infra servers, and
> > newer
> > non cloud builder, but I plan to later also move gerrit/jenkins and
> > various servers.
> > 
> > The goal is to reduce IP v4 usage (cause that's limited), and
> > increase
> > security (no direct access to attack, and more difficult to later
> > exploit in case of compromission).
> > 
> > 
> > That's mostly non impacting people (or I would have asked for
> > maintainance windows) but I just switched all servers in the
> > internal
> > network to use the firewall (masamune.rht.gluster.org) as a gateway
> > rather than IT firewall, so if anything is broken on a
> > *.int.rht.gluster.org server, please tell me and I will look.
> > 
> > Everything is in HA, and I have done several tests and reboot
> > during
> > the day without trouble. In fact, more than half of the servers
> > were
> > using that. 
> > 
> > Right now, the firewall is not yet blocking anything, but that's
> > planned, server by server.
> > 
> > Next steps are to prevent direct internet access (so start to use
> > the
> > firewall), and provides both a web proxy and a dns server, so we
> > can
> > log and control what is going on.
> 
> So I made some progress here (after a rather hectic week, my fault
> for
> not staying in vacation):
> 
> - we have now 2 internal DNS servers (gonna test and switch internal
> builders, etc once I validate them, I will likely do them by small
> batches)

So the 2 DNS servers are working. I didn't yet do switch to them by
default, because I want to do some setup of the disk for squid
(colocated on the same VM) and may need to reinstall, but that part is
done.

> - I start to switch to nftables for the firewall (not enabled yet, I
> will announce in advance and do that outside of working hours)

Same, the testing of nftables seems to be positive. I installed another
server to serve as a temporary firewall, and started to refine the
rules. Still no plan to switch yet, will wait when Nigel is back.

I also slowly started to use a squid proxy for controlling outgoing
http connexion, and so far so good.




-- 
Michael Scherer
Sysadmin, Community Infrastructure and Platform, OSAS

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Gluster-devel mailing list
Gluster-devel@xxxxxxxxxxx
https://lists.gluster.org/mailman/listinfo/gluster-devel

[Index of Archives]     [Gluster Users]     [Ceph Users]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux