Page MenuHomePhabricator
Create Task
Maniphest T114209

Ensure that there are no firewall rules in modules
Open, LowPublic
Actions

Description

Refactor remaining ferm rules to only apply ferm rules in profiles, not in the modules itself.

Remainders:

acme_chief/manifests/server.pp: ferm::service { 'acme-chief-api':
acme_chief/manifests/server.pp: ferm::service { 'acme-chief-http-challenges':
acme_chief/manifests/server.pp: ferm::service { 'acme-chief-ssh-rsync':
airflow/manifests/instance.pp: ferm::service { "airflow-webserver@${title}":
aptly/manifests/init.pp: ferm::service { 'aptly':
base/manifests/firewall.pp: ferm::service { 'ssh-from-cumin-masters':
ganeti/manifests/prometheus.pp: ferm::service {'ganeti-prometheus-exporter':
openstack/manifests/haproxy/site.pp: ferm::service { "${title}_haproxy_backend":
openstack/manifests/haproxy/site.pp: ferm::service { "${title}_public_${index}":
openstack/manifests/haproxy/site.pp: ferm::service { "${title}_internal_${index}":
pontoon/manifests/lb.pp: ferm::service { 'pontoon-lb-dns':
role/manifests/analytics_test_cluster/coordinator.pp: ferm::service{ 'jupyterhub_hub':
role/manifests/puppetmaster/standalone.pp: ferm::service { 'puppetmaster-standalone':
role/manifests/bastionhost.pp: ferm::service { 'ssh':
role/manifests/logging/mediawiki/udp2log.pp: ferm::service { 'xenon_redis':
service/manifests/node.pp: ferm::service { $title:
udp2log/manifests/instance.pp: ferm::service { "udp2log_instance_${port}":

These are fine:
rsync/manifests/server/module.pp: ferm::service { "rsyncd_access_${name}":
rsync/manifests/server/module.pp: ferm::service { "rsyncd_access_${name}_tls":
rsync/manifests/server/module.pp: ferm::service { "rsyncd_access_${name}_ipv6":
rsync/manifests/server/module.pp: ferm::service { "rsyncd_access_${name}_ipv6_tls":
scap/manifests/ferm.pp: ferm::service { 'deployment-ssh':
role/manifests/mariadb/ferm.pp: ferm::service{ 'mariadb_internal':
role/manifests/mariadb/ferm.pp: ferm::service{ 'orchestrator':
ferm/manifests/ipsec_allow.pp: ferm::service { 'ferm-ipsec-ike':
ferm/manifests/service.pp:# == Define ferm::service
ferm/manifests/service.pp:define ferm::service(

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Revert "contint: remove obsolete firewall rules from labs"operations/puppetproduction+16 -0
contint: remove obsolete firewall rules from labsoperations/puppetproduction+0 -22
scap: move firewall rules out of the moduleoperations/puppetproduction+27 -18
phabricator: fix ferm rules for VCS, git-sshoperations/puppetproduction+17 -5
phabricator: move vcs firewall rules to profileoperations/puppetproduction+16 -6
dumps: move ferm rules for xmldumps from module to profileoperations/puppetproduction+10 -10
codesearch: move ferm rules from module to profileoperations/puppetproduction+11 -11
icinga: move ferm rules from module to profileoperations/puppetproduction+11 -9
dynamicproxy: Firewall redis more restrictivelyoperations/puppetproduction+8 -4
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT294906 Puppet Improvements
 OpenNoneT114209 Ensure that there are no firewall rules in modules

Event Timeline

yuvipanda created this task.Sep 30 2015, 3:39 AM
yuvipanda raised the priority of this task from to Needs Triage.
yuvipanda updated the task description. (Show Details)
yuvipanda added a project: acl*sre-team.
yuvipanda subscribed.
Restricted Application added subscribers: Matanya, Aklapper. · View Herald TranscriptSep 30 2015, 3:39 AM
yuvipanda set Security to Software security bug.Sep 30 2015, 3:39 AM
Restricted Application changed the visibility from "Public (No Login Required)" to "Custom Policy". · View Herald TranscriptSep 30 2015, 3:39 AM
Restricted Application changed the edit policy from "All Users" to "Custom Policy". · View Herald Transcript
Restricted Application added a project: acl*security. · View Herald Transcript
yuvipanda mentioned this in rOPUP81325bfbad85: dynamicproxy: Firewall redis more restrictively.Sep 30 2015, 3:54 AM
yuvipanda added a comment.Sep 30 2015, 3:56 AM

https://gerrit.wikimedia.org/r/#/c/242434/ fixes my immediate issue but clearly neds a better implemented solution I think.

yuvipanda edited subscribers, added: MoritzMuehlenhoff; removed: Matanya.Sep 30 2015, 3:57 AM
Dzahn subscribed.Sep 30 2015, 2:57 PM

one of them was: T108987

apache/manifests/static_site.pp: ferm::service { "${servername_safe}_http":
archiva/manifests/proxy.pp: ferm::service { 'https':
archiva/manifests/proxy.pp: ferm::service { 'http':
contint/manifests/firewall.pp: ferm::service { 'gearman_from_zuul_mergers':
contint/manifests/firewall.pp: ferm::service { 'gearman_from_nodepool':
contint/manifests/firewall.pp: ferm::service { 'jenkins_zeromq_from_nodepool':
dataset/manifests/nfs.pp: ferm::service { 'nfs_rpc_mountd':
dataset/manifests/nfs.pp: ferm::service { 'nfs_rpc_statd':
dataset/manifests/nfs.pp: ferm::service { 'nfs_portmapper_udp':
dataset/manifests/nfs.pp: ferm::service { 'nfs_portmapper_tcp':
dynamicproxy/manifests/init.pp: ferm::service { 'proxymanager':
dynamicproxy/manifests/init.pp: ferm::service{ 'http':
dynamicproxy/manifests/init.pp: ferm::service{ 'https':
dynamicproxy/manifests/api.pp: ferm::service { 'dynamicproxy-api-http':
ferm/manifests/service.pp:# == Define ferm::service
ferm/manifests/service.pp:define ferm::service(
hhvm/manifests/admin.pp: ferm::service { 'hhvm_admin':
icinga/manifests/web.pp: ferm::service { 'icinga-https':
icinga/manifests/web.pp: ferm::service { 'icinga-http':
k8s/manifests/flannel.pp: ferm::service { 'flannel-vxlan':
ldap/manifests/server.pp: ferm::service { 'ldap-admin':
ldap/manifests/server.pp: ferm::service { 'ldap-replication':
mediawiki/manifests/jobrunner.pp: ferm::service { 'mediawiki-jobrunner':
memcached/manifests/init.pp: ferm::service {'memcached':
openstack/manifests/controller_firewall.pp: ferm::service { 'mysql_iron':
openstack/manifests/controller_firewall.pp: ferm::service { 'mysql_tendril':
redis/manifests/init.pp: ferm::service {'redis':
service/manifests/node.pp: ferm::service { $title:
statistics/manifests/rsyncd.pp: ferm::service { 'rsync':
toollabs/manifests/proxy.pp: ferm::service { 'redis-replication':
toollabs/manifests/proxy.pp: ferm::service { 'proxylistener-port':
tor/manifests/init.pp: ferm::service { 'tor_orport':
tor/manifests/init.pp: ferm::service { 'tor_dirport':
wdqs/manifests/gui.pp: ferm::service { 'wdqs_http':
wdqs/manifests/gui.pp: ferm::service { 'wdqs_https':

base/manifests/firewall.pp: ferm::rule { 'bastion-ssh':
base/manifests/firewall.pp: ferm::rule { 'monitoring-all':
contint/manifests/firewall.pp: ferm::rule { 'jenkins_localhost_only':
contint/manifests/firewall.pp: ferm::rule { 'zuul_localhost_only':
contint/manifests/firewall.pp: ferm::rule { 'git-daemon_internal':
contint/manifests/firewall.pp: ferm::rule { 'ytterbium_ssh':
contint/manifests/firewall.pp: ferm::rule { 'allow_http':
contint/manifests/firewall.pp: ferm::rule { 'allow_https':
contint/manifests/firewall/labs.pp: ferm::rule { 'gallium_ssh_to_slaves':
ferm/manifests/rule.pp:define ferm::rule(
ganglia/manifests/monitor/aggregator/instance.pp: ferm::rule { "aggregator-udp-${id}":
ganglia/manifests/monitor/aggregator/instance.pp: ferm::rule { "aggregator-tcp-${id}":
icinga/manifests/nsca/firewall.pp: ferm::rule { 'ncsa_allowed':
ldap/manifests/server.pp: ferm::rule { 'ldap_private_labs':
ldap/manifests/server.pp: ferm::rule { 'ldap_backend_private_labs':
nrpe/manifests/init.pp: ferm::rule { 'nrpe_5666':
openstack/manifests/controller_firewall.pp: ferm::rule { 'ssh_public':
openstack/manifests/controller_firewall.pp: ferm::rule { 'http_public':
openstack/manifests/controller_firewall.pp: ferm::rule { 'dns_public':
openstack/manifests/controller_firewall.pp: ferm::rule { 'redis_replication':
openstack/manifests/controller_firewall.pp: ferm::rule { 'openstack-services':
openstack/manifests/controller_firewall.pp: ferm::rule { 'openstack-services-horizon':
openstack/manifests/controller_firewall.pp: ferm::rule { 'keystone':
openstack/manifests/controller_firewall.pp: ferm::rule { 'mysql_nova':
openstack/manifests/controller_firewall.pp: ferm::rule { 'beam_nova':
openstack/manifests/controller_firewall.pp: ferm::rule { 'rabbit_for_designate':
openstack/manifests/controller_firewall.pp: ferm::rule { 'rabbit_for_nova_api':
openstack/manifests/controller_firewall.pp: ferm::rule { 'glance_api_nova':
openstack/manifests/controller_firewall.pp: ferm::rule { 'puppetmaster':
openstack/manifests/controller_firewall.pp: ferm::rule { 'salt':

• csteipp triaged this task as High priority.Sep 30 2015, 11:44 PM
• csteipp subscribed.

Setting this high until we're sure there aren't any services that are accidentally exposed to the world. Then we can set to normal/low to actually move them out of modules.

@MoritzMuehlenhoff, do you seen any of these that seem like the same situation Yuvi hit?

Memcached would be a disaster for any mediawikis.

yuvipanda added a comment.Oct 1 2015, 1:49 AM

I can access memcached from bastions, not sure if that's intended?

yuvipanda added a comment.Oct 1 2015, 1:50 AM

Ah I see no ferm rules in the role, so looks like that's intentional at least for now.

MoritzMuehlenhoff added a comment.Oct 1 2015, 1:04 PM

As said, the rules will be refactored into the roles over time, no services in prod are exposed by this (after all before ferm was enabled these hosts weren't firewalled at all).

I'll prepare a patch for the redis rule today or tomorrow.

MoritzMuehlenhoff added a comment.Oct 1 2015, 4:16 PM

I made https://gerrit.wikimedia.org/r/#/c/242915/ for redis

MoritzMuehlenhoff added a comment.Oct 5 2015, 11:15 AM

The redis change has just been merged.

MoritzMuehlenhoff added a comment.Oct 5 2015, 2:19 PM

I have created https://gerrit.wikimedia.org/r/#/c/243651 and https://gerrit.wikimedia.org/r/#/c/243652 for memcached.

Yuvi, it would be great if you could double-check whether systems in labs need updated rules.

MoritzMuehlenhoff added a comment.Oct 7 2015, 9:20 AM

The memcached refactoring patches have been merged.

MoritzMuehlenhoff added a comment.Oct 7 2015, 9:32 AM

The others classes are not use in multiple places and will be cleaned up over time.

There's also a bit of technical debt around; e.g. the ldap server module doesn't use a role yet.

Krenair subscribed.Nov 16 2015, 10:53 PM
MoritzMuehlenhoff claimed this task.Mar 2 2016, 2:02 PM
MoritzMuehlenhoff lowered the priority of this task from High to Low.
MoritzMuehlenhoff updated the task description. (Show Details)
Bawolff moved this task from Backlog / Other to Operational issues on the acl*security board.Jul 10 2016, 6:00 PM
yuvipanda unsubscribed.Jun 7 2017, 7:57 PM
• chasemp added a project: Security.Feb 10 2020, 11:00 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:08 PM
Aklapper removed MoritzMuehlenhoff as the assignee of this task.Jun 19 2020, 4:29 PM

This task has been assigned to the same task owner for more than two years. Resetting task assignee due to inactivity, to decrease task cookie-licking and to get a slightly more realistic overview of plans. Please feel free to assign this task to yourself again if you still realistically work or plan to work on this task - it would be welcome!

For tips how to manage individual work in Phabricator (noisy notifications, lists of task, etc.), see https://phabricator.wikimedia.org/T228575#6237124 for available options.
(For the records, two emails were sent to assignee addresses before resetting assignees. See T228575 for more info and for potential feedback. Thanks!)

Dzahn added a comment.Jun 19 2020, 4:54 PM

as of today:

acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-api':
acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-http-challenges':
acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-ssh-rsync':
aptly/manifests/init.pp:    ferm::service { 'aptly':
base/manifests/firewall.pp:    ::ferm::service { 'ssh-from-cumin-masters':
codesearch/manifests/init.pp:    ferm::service { 'codesearch':
contint/manifests/firewall/labs.pp:    ferm::service { 'contint1001_ssh_to_slaves':
contint/manifests/firewall/labs.pp:    ferm::service { 'contint2001_ssh_to_slaves':
dumps/manifests/web/xmldumps.pp:    ferm::service { 'xmldumps_http':
dumps/manifests/web/xmldumps.pp:    ferm::service { 'xmldumps_https':
ferm/manifests/service.pp:# == Define ferm::service
ferm/manifests/service.pp:define ferm::service(
ferm/manifests/ipsec_allow.pp:    ferm::service { 'ferm-ipsec-ike':
icinga/manifests/web.pp:    ferm::service { 'icinga-https':
icinga/manifests/web.pp:    ferm::service { 'icinga-http':
phabricator/manifests/vcs.pp:        ferm::service {'ssh_public':
prometheus/manifests/blazegraph_exporter.pp:    ferm::service { "prometheus-blazegraph-exporter-${title}":
rsync/manifests/server/module.pp:      ferm::service { "rsyncd_access_${name}":
rsync/manifests/server/module.pp:          ferm::service { "rsyncd_access_${name}_tls":
rsync/manifests/server/module.pp:          ferm::service { "rsyncd_access_${name}_ipv6":
rsync/manifests/server/module.pp:              ferm::service { "rsyncd_access_${name}_ipv6_tls":
scap/manifests/ferm.pp:    ferm::service { 'deployment-ssh':
service/manifests/node.pp:    ferm::service { $title:
udp2log/manifests/instance.pp:    ferm::service { "udp2log_instance_${port}":
Dzahn removed a project: Security.Jun 25 2020, 8:13 PM
Dzahn changed the visibility from "Custom Policy" to "Public (No Login Required)".
Dzahn changed the edit policy from "Custom Policy" to "All Users".
Dzahn added a comment.Jun 25 2020, 8:23 PM

recently fixed:

icinga: https://gerrit.wikimedia.org/r/c/operations/puppet/+/606730
codesearch: https://gerrit.wikimedia.org/r/c/operations/puppet/+/606735
dumps: https://gerrit.wikimedia.org/r/c/operations/puppet/+/606739
contint: https://gerrit.wikimedia.org/r/c/operations/puppet/+/606737

Dzahn updated the task description. (Show Details)Jun 25 2020, 8:25 PM

modules that still have a ferm::service as of today:

acme_chief
aptly
base
phabricator
prometheus
rsync
scap
service
udp2log

added check boxes

Marostegui added a project: Puppet.May 26 2021, 6:47 AM
Aklapper added a project: Infrastructure-Foundations.Jun 21 2021, 9:00 PM
jbond added a parent task: T294906: Puppet Improvements.Nov 3 2021, 12:13 PM
taavi updated the task description. (Show Details)Jan 4 2022, 7:18 PM
Dzahn added a comment.Jan 4 2022, 9:55 PM

I would feel responsible for the "phabricator" one here but I am not doing that because we have T296022 anyways. And if that happens we will remove the entire code section that this is in while otherwise we'd have to do quite some refactoring.

gerritbot added a comment.Jan 4 2022, 10:20 PM

Change 751510 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] phabricator: move vcs firewall rules to profile

https://gerrit.wikimedia.org/r/751510

gerritbot added a project: Patch-For-Review.Jan 4 2022, 10:20 PM
gerritbot added a comment.Jan 12 2022, 6:38 PM

Change 751510 merged by Dzahn:

[operations/puppet@production] phabricator: move vcs firewall rules to profile

https://gerrit.wikimedia.org/r/751510

Maintenance_bot removed a project: Patch-For-Review.Jan 12 2022, 7:11 PM
gerritbot added a comment.Jan 12 2022, 9:14 PM

Change 753555 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] phabricator: fix ferm rules for VCS, git-ssh

https://gerrit.wikimedia.org/r/753555

gerritbot added a project: Patch-For-Review.Jan 12 2022, 9:14 PM

Change 753555 merged by Dzahn:

[operations/puppet@production] phabricator: fix ferm rules for VCS, git-ssh

https://gerrit.wikimedia.org/r/753555

Dzahn updated the task description. (Show Details)Jan 12 2022, 9:25 PM

phabricator done anways

Maintenance_bot removed a project: Patch-For-Review.Jan 12 2022, 10:10 PM
Dzahn added a comment.Nov 30 2022, 11:49 PM

status nowadays:

~/puppet/modules$ grep -r ferm::service * | grep -v profile

acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-api':
acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-http-challenges':
acme_chief/manifests/server.pp:    ferm::service { 'acme-chief-ssh-rsync':
airflow/manifests/instance.pp:    ferm::service { "airflow-webserver@${title}":
aptly/manifests/init.pp:    ferm::service { 'aptly':
base/manifests/firewall.pp:    ferm::service { 'ssh-from-cumin-masters':
ferm/manifests/ipsec_allow.pp:    ferm::service { 'ferm-ipsec-ike':
ferm/manifests/service.pp:# == Define ferm::service
ferm/manifests/service.pp:define ferm::service(
ganeti/manifests/prometheus.pp:    ferm::service {'ganeti-prometheus-exporter':
openstack/manifests/haproxy/site.pp:        ferm::service { "${title}_haproxy_backend":
openstack/manifests/haproxy/site.pp:            ferm::service { "${title}_public_${index}":
openstack/manifests/haproxy/site.pp:            ferm::service { "${title}_internal_${index}":
pontoon/manifests/lb.pp:    ferm::service { 'pontoon-lb-dns':
role/manifests/analytics_test_cluster/coordinator.pp:    ferm::service{ 'jupyterhub_hub':
role/manifests/puppetmaster/standalone.pp:    ferm::service { 'puppetmaster-standalone':
role/manifests/bastionhost.pp:    ferm::service { 'ssh':
role/manifests/mariadb/ferm.pp:    ferm::service{ 'mariadb_internal':
role/manifests/mariadb/ferm.pp:    ferm::service{ 'orchestrator':
role/manifests/logging/mediawiki/udp2log.pp:    ferm::service { 'xenon_redis':
rsync/manifests/server/module.pp:      ferm::service { "rsyncd_access_${name}":
rsync/manifests/server/module.pp:          ferm::service { "rsyncd_access_${name}_tls":
rsync/manifests/server/module.pp:          ferm::service { "rsyncd_access_${name}_ipv6":
rsync/manifests/server/module.pp:              ferm::service { "rsyncd_access_${name}_ipv6_tls":
scap/manifests/ferm.pp:    ferm::service { 'deployment-ssh':
service/manifests/node.pp:    ferm::service { $title:
udp2log/manifests/instance.pp:    ferm::service { "udp2log_instance_${port}":

Let's still fix those

gerritbot added a comment.Dec 1 2022, 12:01 AM

Change 862378 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] scap: move firewall rules out of the module

https://gerrit.wikimedia.org/r/862378

gerritbot added a project: Patch-For-Review.Dec 1 2022, 12:01 AM
gerritbot added a comment.Dec 1 2022, 1:28 PM

Change 862378 abandoned by Dzahn:

[operations/puppet@production] scap: move firewall rules out of the module

Reason:

per inline comments, this use case is ok, it's already a separate class just for ferm rules

https://gerrit.wikimedia.org/r/862378

Maintenance_bot removed a project: Patch-For-Review.Dec 1 2022, 1:31 PM
MoritzMuehlenhoff updated the task description. (Show Details)Dec 1 2022, 2:19 PM
MoritzMuehlenhoff updated the task description. (Show Details)
MoritzMuehlenhoff updated the task description. (Show Details)Dec 1 2022, 4:51 PM
gerritbot added a comment.Feb 8 2023, 9:31 AM

Change 887363 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/puppet@production] Revert "contint: remove obsolete firewall rules from labs"

https://gerrit.wikimedia.org/r/887363

gerritbot added a project: Patch-For-Review.Feb 8 2023, 9:31 AM
gerritbot added a comment.Feb 8 2023, 7:56 PM

Change 887363 merged by Dzahn:

[operations/puppet@production] Revert "contint: remove obsolete firewall rules from labs"

https://gerrit.wikimedia.org/r/887363

Maintenance_bot removed a project: Patch-For-Review.Feb 8 2023, 8:30 PM
jbond edited projects, added Puppet-Core; removed Infrastructure-Foundations, Puppet.Jul 3 2023, 3:28 PM
Dzahn unsubscribed.Jul 5 2023, 5:34 PM
akosiaris subscribed.Jul 6 2023, 3:22 PM
andrea.denisse subscribed.Jul 18 2023, 6:09 AM
Clement_Goubert removed a project: SRE.Aug 16 2023, 10:01 AM
Clement_Goubert added a project: SRE.Aug 16 2023, 10:06 AM
Clement_Goubert added a project: Infrastructure-Foundations.Aug 16 2023, 10:10 AM
Clement_Goubert subscribed.

Re-adding SRE and Infrastructure-Foundations since this is cross-SRE work under IF stewardship.

Clement_Goubert unsubscribed.Aug 16 2023, 10:10 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits