Working on a Kibana dashboard for iptables I noticed that a lot of internal hosts try to reach phab1003 on port 22280/tcp
See https://logstash.wikimedia.org/goto/23faeb7f40dc1205cb58007b65020c68
Maybe there is a miss-configuration somewhere or a missing ferm rule?
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| varnish: remove config for disabled phab_aphlict | operations/puppet | production | +0 -15 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • chasemp | T1047 Phabricator lacks a "notification" feed similar other project management software: Enable "Flame" | |||
| Resolved | • mmodell | T75791 Following Notification from "bell" menu does not clear notification | |||
| Resolved | • mmodell | T103444 Desktop notifications | |||
| Resolved | • mmodell | T97650 Conpherence wont refresh chat messages automatically, needs manual reload | |||
| Resolved | • mmodell | T765 Enable notification server (real-time pop-up notifications) in Phabricator | |||
| Resolved | Dzahn | T238593 Phabricator downtime due to aphlict and websockets (aphlict current disabled) | |||
| Resolved | Dzahn | T238781 dropped packets to phab1003 22280/tcp |
Port 22280/tcp is the aphlict service which is currently disabled (T238593).
In addition to the backend It has also been disabled in ATS (https://gerrit.wikimedia.org/r/c/operations/puppet/+/551731)
Change 552122 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] varnish: remove config for disabled phab_aphlict
@ema @Vgutierrez So this was removed from ATS in https://gerrit.wikimedia.org/r/c/operations/puppet/+/551731 but does it also need https://gerrit.wikimedia.org/r/c/operations/puppet/+/552122 ?
The source hosts in the logstash link above are several cp servers.
f.e. :
10.64.48.101 - cp1087
10.64.32.67 - cp1083
2620:0:861:103:10:64:32:67 - cp1083
10.64.32.69 - cp1085
@Dzahn that's right, Removing the wss:// -> ws:// from ats-tls doesn't stop the requests from reaching varnish-fe as they are accepted as part of the catch-all remap rule.
Change 552122 merged by Dzahn:
[operations/puppet@production] varnish: remove config for disabled phab_aphlict